Splunk unknown stable spl

AWS New MFA Method Registered For User

The following analytic detects the registration of a new Multi-Factor Authentication (MFA) method for an AWS account. It leverages AWS CloudTrail logs to identify the `CreateVirtualMFADevice` event. This activity is significant because adversaries who gain unauthorized access to an AWS account may register a new MFA method to maintain persistence. If confirmed malicious, this could allow attackers to secure their access, making it difficult to detect and remove their presence, potentially leading to further unauthorized activities and data breaches.

View Source

Detection Logic

`cloudtrail` eventName=CreateVirtualMFADevice
| rename userName as user
| stats count min(_time) as firstTime max(_time) as lastTime
    BY signature dest user
       user_agent src vendor_account
       vendor_region vendor_product
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `aws_new_mfa_method_registered_for_user_filter`

False Positives

  • ⚠ Newly onboarded users who are registering an MFA method for the first time will also trigger this detection.

Field Validations

Loading…

Comments (0)

Loading comments...