detection.wiki

Detection rules › Sublime MQL

DLP: AWS Credentials

Severity
high
Type
dlp
Source
github.com/sublime-security/sublime-rules

Detects messages containing AWS access keys and secret keys.

Event coverage

Message attribute
body.current_thread
subject
type

Rule body MQL

type.outbound
and any([body.current_thread.text, subject.subject],
        // AWS Access Key ID: AKIA followed by 16 alphanumeric characters
        regex.contains(., '\bAKIA[0-9A-Z]{16}\b')
)
and (
  any([body.current_thread.text, subject.subject],
          regex.icontains(., 'aws|amazon|access\s+key|secret\s+key')
  )
  or any([body.current_thread.text, subject.subject],
          // AWS Secret Access Key: 40-character base64 string
          regex.contains(., '\b[A-Za-z0-9/+=]{40}\b')
  )
)

Detection logic

Scope: outbound message.

Detects messages containing AWS access keys and secret keys.

  1. outbound message
  2. any of [body.current_thread.text, subject.subject] where:
    • . matches '\\bAKIA[0-9A-Z]{16}\\b'
  3. any of:
    • any of [body.current_thread.text, subject.subject] where:
      • . matches 'aws|amazon|access\\s+key|secret\\s+key'
    • any of [body.current_thread.text, subject.subject] where:
      • . matches '\\b[A-Za-z0-9/+=]{40}\\b'

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: regex.contains, regex.icontains.

Indicators matched (3)

FieldMatchValue
regex.containsregex\bAKIA[0-9A-Z]{16}\b
regex.icontainsregexaws|amazon|access\s+key|secret\s+key
regex.containsregex\b[A-Za-z0-9/+=]{40}\b