Detection: Detect AWS Console Login by User from New City

Description

The following analytic identifies AWS console login events by users from a new city within the last hour. It leverages AWS CloudTrail events and compares them against a lookup file of previously seen user locations. This activity is significant for a SOC as it may indicate unauthorized access or credential compromise, especially if the login originates from an unusual location. If confirmed malicious, this could lead to unauthorized access to AWS resources, data exfiltration, or further exploitation within the cloud environment.

Search

 1
 2| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src 
 3| iplocation Authentication.src 
 4| `drop_dm_object_name(Authentication)` 
 5| rename City as justSeenCity 
 6| table firstTime lastTime user justSeenCity 
 7| join user type=outer [
 8| inputlookup previously_seen_users_console_logins 
 9| rename City as previouslySeenCity 
10| stats min(firstTime) AS earliestseen by user previouslySeenCity 
11| fields earliestseen user previouslySeenCity] 
12| eval userCity=if(firstTime >= relative_time(now(), "-24h@h"), "New City","Previously Seen City") 
13| where userCity = "New City" 
14| `security_content_ctime(firstTime)` 
15| `security_content_ctime(lastTime)` 
16| table firstTime lastTime user previouslySeenCity justSeenCity userCity 
17| `detect_aws_console_login_by_user_from_new_city_filter`

Data Source

Name	Platform	Sourcetype	Source	Supported App
AWS CloudTrail	AWS	'aws:cloudtrail'	'aws_cloudtrail'	N/A

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the Previously Seen Users in AWS CloudTrail - Initial support search only once to create a baseline of previously seen IAM users within the last 30 days. Run Previously Seen Users in AWS CloudTrail - Update hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the detect_aws_console_login_by_user_from_new_city_filter macro.

Known False Positives

When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.

Associated Analytic Story

• AWS Identity and Access Management Account Takeover

• Compromised User Account

• Suspicious AWS Login Activities

• Suspicious Cloud Authentication Activities

Risk Based Analytics (RBA)

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 3