[metadata]
creation_date = "2020/05/26"
maturity = "production"
updated_date = "2020/10/26"

[rule]
author = ["Elastic"]
description = """
Identifies the deactivation of a specified multi-factor authentication (MFA) device and removes it from association with
the user name for which it was originally enabled. In AWS Identity and Access Management (IAM), a device must be
deactivated before it can be deleted.
"""
false_positives = [
    """
    A MFA device may be deactivated by a system or network administrator. Verify whether the user identity, user agent,
    and/or hostname should be making changes in your environment. MFA device deactivations from unfamiliar users or
    hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
    """,
]
from = "now-60m"
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
name = "AWS IAM Deactivation of MFA Device"
note = "The AWS Filebeat module must be enabled to use this rule."
references = [
    "https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/deactivate-mfa-device.html",
    "https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeactivateMFADevice.html",
]
risk_score = 47
rule_id = "d8fc1cca-93ed-43c1-bbb6-c0dd3eff2958"
severity = "medium"
tags = ["Elastic", "Cloud", "AWS", "Continuous Monitoring", "SecOps", "Monitoring"]
type = "query"

query = '''
event.action:DeactivateMFADevice and event.dataset:aws.cloudtrail and event.provider:iam.amazonaws.com and event.outcome:success
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1531"
name = "Account Access Removal"
reference = "https://attack.mitre.org/techniques/T1531/"


[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

