Splunk unknown stable spl

ASL AWS Detect Users creating keys with encrypt policy without MFA

The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. It leverages AWS CloudTrail logs from Amazon Security Lake to identify `CreateKey` or `PutKeyPolicy` events where the `kms:Encrypt` action is granted to all principals. This activity is significant as it may indicate a compromised account, allowing an attacker to misuse the encryption key to target other organizations. If confirmed malicious, this could lead to unauthorized data encryption, potentially disrupting operations and compromising sensitive information across multiple entities.

View Source

Detection Logic

`amazon_security_lake` api.operation=PutKeyPolicy 
OR api.operation=CreateKey
| spath input=api.request.data path=policy output=policy
| spath input=policy
| rename Statement{}.Action as Action, Statement{}.Principal as Principal
| eval Statement=mvzip(Action,Principal,"
| ")
| mvexpand Statement
| eval action=mvindex(split(Statement, "
| "), 0)
| eval principal=mvindex(split(Statement, "
| "), 1)
| search action=kms*
| regex principal="\*"
| fillnull
| stats count min(_time) as firstTime max(_time) as lastTime
    BY actor.user.uid api.operation api.service.name
       http_request.user_agent src_endpoint.ip actor.user.account.uid
       cloud.provider cloud.region api.request.data
| rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `asl_aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter`

False Positives

⚠ No false positives have been identified at this time.

Field Validations

Loading…

Comments (0)

Loading comments...