AWS User Monitoring

• AWS Excessive Security Scanning :
  network AWS Account None version:10
  The following analytic identifies excessive security scanning activities in AWS by detecting a high number of Describe, List, or Get API calls from a single user. It leverages AWS CloudTrail logs to count distinct event names and flags users with more than 50 such events. This behavior is significant as it may indicate reconnaissance activities by an attacker attempting to map out your AWS environment. If confirmed malicious, this could lead to unauthorized access, data exfiltration, or further exploitation of your cloud infrastructure.


• Detect new API calls from user roles :
  endpoint AWS Instance 2024-11-14 version:4
  This search detects new API calls that have either never been seen before or that have not been seen in the previous hour, where the identity type is `AssumedRole`.


• Detect API activity from users without MFA :
  network AWS Instance 2024-11-14 version:4
  This search looks for AWS CloudTrail events where a user logged into the AWS account, is making API calls and has not enabled Multi Factor authentication. Multi factor authentication adds a layer of security by forcing the users to type a unique authentication code from an approved authentication device when they access AWS websites or services. AWS Best Practices recommend that you enable MFA for privileged IAM users.


• Detect Spike in AWS API Activity :
  network AWS Instance 2024-11-14 version:5
  This search will detect users creating spikes of API activity in your AWS environment. It will also update the cache file that factors in the latest data. This search is deprecated and have been translated to use the latest Change Datamodel.


• Detect AWS API Activities From Unapproved Accounts :
  access AWS Instance 2024-11-14 version:5
  This search looks for successful AWS CloudTrail activity by user accounts that are not listed in the identity table or `aws_service_accounts.csv`. It returns event names and count, as well as the first and last time a specific user or service is detected, grouped by users. Deprecated because managing this list can be quite hard.


• Detect Spike in Security Group Activity :
  network AWS Instance 2024-11-14 version:4
  This search will detect users creating spikes in API activity related to security groups in your AWS environment. It will also update the cache file that factors in the latest data. This search is deprecated and have been translated to use the latest Change Datamodel.


• ASL AWS Excessive Security Scanning :
  network AWS Account 2024-11-14 version:4
  This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment.