elastic / elastic/detection-rules

[New Rule] AWS - possible compromised access keys [ML]

Open
#1,919 3 comments 0 reactions 0 assignees View on GitHub
backlog community Domain: Cloud Workloads Integration: AWS ML Rule: New
Dominant language
Python
Stars
2.7k
Forks
696
Avg merge
4d 17h
Merged PRs (30d)
87

Description

## Description

AWS IAM users can generate access key credentials to be used in CLI or other API applications, in case of access key+secret leakage it might be difficult to detect the malicious activity, it is possible based on AWS Cloudtrail log and a and machine learning job to detect a possible compromised access keys.

## Required Info

### Target indexes

logs-aws*

### Additional requirements

Machine Learning

### Platforms

AWS Cloudtrail

### Tested ECS Version
1.6.0

## Optional Info
https://www.linkedin.com/pulse/detecting-compromised-access-key-aws-guy-dahan

### Query
based on ML job, score threshold 50

### New fields required in ECS/data sources for this rule?
user_identity.accessKeyId

## Example Data

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.