detection.wiki

Detection rules › Splunk

Detect AWS Console Login by New User

Status
production
Group by
user
Author
Rico Valdez, Splunk
Source
github.com/splunk/security_content

The following analytic detects AWS console login events by new users. It leverages AWS CloudTrail events and compares them against a lookup file of previously seen users based on ARN values. This detection is significant because a new user logging into the AWS console could indicate the creation of new accounts or potential unauthorized access. If confirmed malicious, this activity could lead to unauthorized access to AWS resources, data exfiltration, or further exploitation within the cloud environment.

MITRE ATT&CK coverage

TacticTechniques
Resource DevelopmentT1586.003 Compromise Accounts: Cloud Accounts
Credential AccessT1552 Unsecured Credentials

Rule body splunk

name: Detect AWS Console Login by New User
id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71
version: 11
creation_date: '2020-10-26'
modification_date: '2026-05-13'
author: Rico Valdez, Splunk
status: production
type: Hunting
description: The following analytic detects AWS console login events by new users. It leverages AWS CloudTrail events and compares them against a lookup file of previously seen users based on ARN values. This detection is significant because a new user logging into the AWS console could indicate the creation of new accounts or potential unauthorized access. If confirmed malicious, this activity could lead to unauthorized access to AWS resources, data exfiltration, or further exploitation within the cloud environment.
data_source:
    - AWS CloudTrail
search: |-
    | tstats earliest(_time) as firstTime latest(_time) as lastTime FROM datamodel=Authentication
      WHERE Authentication.signature=ConsoleLogin
      BY Authentication.user
    | `drop_dm_object_name(Authentication)`
    | join user type=outer [
    | inputlookup previously_seen_users_console_logins
    | stats min(firstTime) as earliestseen
      BY user]
    | eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h") OR isnull(earliestseen), "First Time Logging into AWS Console", "Previously Seen User")
    | where userStatus="First Time Logging into AWS Console"
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_aws_console_login_by_new_user_filter`
how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines.
known_false_positives: When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.
references: []
analytic_story:
    - Suspicious Cloud Authentication Activities
    - AWS Identity and Access Management Account Takeover
asset_type: AWS Instance
mitre_attack_id:
    - T1552
    - T1586.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat
baselines:
    - Previously Seen Users in CloudTrail - Initial
    - Previously Seen Users In CloudTrail - Update
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
          sourcetype: aws:cloudtrail
          source: aws_cloudtrail
      description: PORTED MANUAL TEST - This search needs the baseline `Previously Seen Users in CloudTrail - Initial` to be run first.
      test_type: experimental

Stages and Predicates

Stage 1: tstats

| tstats earliest(_time) as firstTime latest(_time) as lastTime FROM datamodel=Authentication
  WHERE Authentication.signature=ConsoleLogin
  BY Authentication.user

Stage 2: search

| `drop_dm_object_name(Authentication)`

Stage 3: join

| join user type=outer [
| inputlookup previously_seen_users_console_logins
| stats min(firstTime) as earliestseen
  BY user]

Stage 4: eval

| eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h") OR isnull(earliestseen), "First Time Logging into AWS Console", "Previously Seen User")
userStatus =
1."First Time Logging into AWS Console"
-"Previously Seen User"(default)

Stage 5: where

| where userStatus="First Time Logging into AWS Console"

Stage 6: search

| `security_content_ctime(firstTime)`

Stage 7: search

| `security_content_ctime(lastTime)`

Stage 8: search

| `detect_aws_console_login_by_new_user_filter`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Authentication.signatureeq
  • ConsoleLogin
userStatuseq
  • "First Time Logging into AWS Console"