AWS New MFA Method Registered For User

Status: production
Severity: medium
Group by: aws::awsRegion, aws::recipientAccountId, aws::userAgent, dest, signature, src, user, vendor_product
Author: Bhavin Patel, Splunk
Source: github.com/splunk/security_content

The following analytic detects the registration of a new Multi-Factor Authentication (MFA) method for an AWS account. It leverages AWS CloudTrail logs to identify the CreateVirtualMFADevice event. This activity is significant because adversaries who gain unauthorized access to an AWS account may register a new MFA method to maintain persistence. If confirmed malicious, this could allow attackers to secure their access, making it difficult to detect and remove their presence, potentially leading to further unauthorized activities and data breaches.

Known false positives

Newly onboarded users who are registering an MFA method for the first time will also trigger this detection.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1556.006` Modify Authentication Process: Multi-Factor Authentication
Defense Impairment	`T1556.006` Modify Authentication Process: Multi-Factor Authentication
Credential Access	`T1556.006` Modify Authentication Process: Multi-Factor Authentication

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `CreateVirtualMFADevice`: Creates a new virtual MFA device and returns the QR code seed for enrollment.

Rules detecting the same action

These rules filter on the same operation.

ASL AWS New MFA Method Registered For User (Splunk)
User impersonation by Identity Protection alerts (Kusto)

Rule body

name: AWS New MFA Method Registered For User
id: 4e3c26f2-4fb9-4bd7-ab46-1b76ffa2a23b
version: 12
creation_date: '2023-01-31'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic detects the registration of a new Multi-Factor Authentication (MFA) method for an AWS account. It leverages AWS CloudTrail logs to identify the `CreateVirtualMFADevice` event. This activity is significant because adversaries who gain unauthorized access to an AWS account may register a new MFA method to maintain persistence. If confirmed malicious, this could allow attackers to secure their access, making it difficult to detect and remove their presence, potentially leading to further unauthorized activities and data breaches.
data_source:
    - AWS CloudTrail CreateVirtualMFADevice
search: |-
    `cloudtrail` eventName=CreateVirtualMFADevice
      | rename userName as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_new_mfa_method_registered_for_user_filter`
how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This search works when AWS CloudTrail logs.
known_false_positives: Newly onboarded users who are registering an MFA method for the first time will also trigger this detection.
references:
    - https://aws.amazon.com/blogs/security/you-can-now-assign-multiple-mfa-devices-in-iam/
    - https://attack.mitre.org/techniques/T1556/
    - https://attack.mitre.org/techniques/T1556/006/
    - https://twitter.com/jhencinski/status/1618660062352007174
finding:
    title: A new virtual device is added to user $user$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - AWS Identity and Access Management Account Takeover
asset_type: AWS Account
mitre_attack_id:
    - T1556.006
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

Stages and Predicates

Stage 1: `search`

`cloudtrail` eventName=CreateVirtualMFADevice

Stage 2: `rename`

| rename userName as user

Stage 3: `stats`

| stats count min(_time) as firstTime max(_time) as lastTime
    BY signature dest user
       user_agent src vendor_account
       vendor_region vendor_product

Stage 4: `search`

| `security_content_ctime(firstTime)`

Stage 5: `search`

| `security_content_ctime(lastTime)`

Stage 6: `search`

| `aws_new_mfa_method_registered_for_user_filter`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`CreateVirtualMFADevice`	`field:"aws::eventName" kind:eq value:"CreateVirtualMFADevice"`
`sourcetype`	eq	`aws:cloudtrail`	`field:"sourcetype" kind:eq value:"aws:cloudtrail"`