Justin Ibarra
56 lines
1.9 KiB
TOML
56 lines
1.9 KiB
TOML
[metadata]
|
|
creation_date = "2020/05/26"
|
|
maturity = "production"
|
|
updated_date = "2021/03/03"
|
|
|
|
[rule]
|
|
author = ["Elastic"]
|
|
description = """
|
|
Identifies the deactivation of a specified multi-factor authentication (MFA) device and removes it from association with
|
|
the user name for which it was originally enabled. In AWS Identity and Access Management (IAM), a device must be
|
|
deactivated before it can be deleted.
|
|
"""
|
|
false_positives = [
|
|
"""
|
|
A MFA device may be deactivated by a system or network administrator. Verify whether the user identity, user agent,
|
|
and/or hostname should be making changes in your environment. MFA device deactivations from unfamiliar users or
|
|
hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
|
|
""",
|
|
]
|
|
from = "now-60m"
|
|
index = ["filebeat-*", "logs-aws*"]
|
|
interval = "10m"
|
|
language = "kuery"
|
|
license = "Elastic License v2"
|
|
name = "AWS IAM Deactivation of MFA Device"
|
|
note = "The AWS Filebeat module must be enabled to use this rule."
|
|
references = [
|
|
"https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/deactivate-mfa-device.html",
|
|
"https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeactivateMFADevice.html",
|
|
]
|
|
risk_score = 47
|
|
rule_id = "d8fc1cca-93ed-43c1-bbb6-c0dd3eff2958"
|
|
severity = "medium"
|
|
tags = ["Elastic", "Cloud", "AWS", "Continuous Monitoring", "SecOps", "Monitoring"]
|
|
timestamp_override = "event.ingested"
|
|
type = "query"
|
|
|
|
query = '''
|
|
event.action:DeactivateMFADevice and event.dataset:aws.cloudtrail and event.provider:iam.amazonaws.com and event.outcome:success
|
|
'''
|
|
|
|
|
|
[[rule.threat]]
|
|
framework = "MITRE ATT&CK"
|
|
[[rule.threat.technique]]
|
|
id = "T1531"
|
|
name = "Account Access Removal"
|
|
reference = "https://attack.mitre.org/techniques/T1531/"
|
|
|
|
|
|
[rule.threat.tactic]
|
|
id = "TA0040"
|
|
name = "Impact"
|
|
reference = "https://attack.mitre.org/tactics/TA0040/"
|
|
|