elastic / elastic/detection-rules
[New Rule] AWS - possible compromised access keys [ML]
- Dominant language
- Python
- Stars
- 2.7k
- Forks
- 696
- Avg merge
- 4d 17h
- Merged PRs (30d)
- 87
Description
## Description
AWS IAM users can generate access key credentials to be used in CLI or other API applications, in case of access key+secret leakage it might be difficult to detect the malicious activity, it is possible based on AWS Cloudtrail log and a and machine learning job to detect a possible compromised access keys.
## Required Info
### Target indexes
logs-aws*
### Additional requirements
Machine Learning
### Platforms
AWS Cloudtrail
### Tested ECS Version
1.6.0
## Optional Info
https://www.linkedin.com/pulse/detecting-compromised-access-key-aws-guy-dahan
### Query
based on ML job, score threshold 50
### New fields required in ECS/data sources for this rule?
user_identity.accessKeyId
## Example Data
Contributor guide
Assessment
This issue has not been assessed yet.