Detection: Detect AWS API Activities From Unapproved Accounts

REMOVED DETECTION

This detection has been removed from the Splunk Threat Research content library and is no longer maintained or supported.

Reason: Detection deprecated as it no longer effectively identifies the intended malicious activity

Removed in version: 5.2.0

If you have any questions or concerns, please reach out to us at research@splunk.com.

Updated Date: 2026-05-13 ID: ada0f478-84a8-4641-a3f1-d82362d4bd55 Author: Bhavin Patel, Splunk Type: Hunting Product: Splunk Enterprise Security

Description

This search looks for successful AWS CloudTrail activity by user accounts that are not listed in the identity table or aws_service_accounts.csv. It returns event names and count, as well as the first and last time a specific user or service is detected, grouped by users. Deprecated because managing this list can be quite hard.

Search

 1`cloudtrail` errorCode=success 
 2| rename userName as identity 
 3| search NOT [
 4| inputlookup identity_lookup_expanded 
 5| fields identity] 
 6| search NOT [
 7| inputlookup aws_service_accounts 
 8| fields identity] 
 9| rename identity as user 
10| stats count min(_time) as firstTime max(_time) as lastTime values(eventName) as eventName by user 
11| `security_content_ctime(firstTime)` 
12| `security_content_ctime(lastTime)` 
13| `detect_aws_api_activities_from_unapproved_accounts_filter`

Data Source

No data sources specified for this detection.

Macros Used

Name	Value
cloudtrail	`sourcetype=aws:cloudtrail`
detect_aws_api_activities_from_unapproved_accounts_filter	``

detect_aws_api_activities_from_unapproved_accounts_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1078.004	Cloud Accounts	Initial Access

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`N/A`
Earliest Time	`N/A`
Latest Time	`N/A`
Schedule Window	`N/A`
Creates Finding (Notable)	No
Creates Intermediate Finding (Risk Event)	No

Hunting detections do not generate a Finding (Notable) or Intermediate Findings (Risk Events).

Implementation

You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You must also populate the identity_lookup_expanded lookup shipped with the Asset and Identity framework to be able to look up users in your identity table in Enterprise Security (ES). Leverage the support search called "Create a list of approved AWS service accounts": run it once every 30 days to create and validate a list of service accounts. This search produces fields (eventName,firstTime,lastTime) that are not yet supported by ES Incident Review and therefore cannot be viewed when a notable event is raised. These fields contribute additional context to the notable. To see the additional metadata, add the following fields, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):

Label: AWS Event Name, Field: eventName
Label: First Time, Field: firstTime
Label: Last Time, Field: lastTime Detailed documentation on how to create a new field within Incident Review may be found here: https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details

Known False Positives

It's likely that you'll find activity detected by users/service accounts that are not listed in the identity_lookup_expanded or aws_service_accounts.csv file. If the user is a legitimate service account, update the aws_service_accounts.csv table with that entry.

Associated Analytic Story

AWS User Monitoring

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	Not Applicable	N/A	N/A	N/A
Unit	Not Applicable	N/A	`N/A`	`N/A`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 5