[New Rule] AWS - possible compromised access keys [ML]

[guyrdahan]

Description

AWS IAM users can generate access key credentials to be used in CLI or other API applications, in case of access key+secret leakage it might be difficult to detect the malicious activity, it is possible based on AWS Cloudtrail log and a and machine learning job to detect a possible compromised access keys.

Required Info

Target indexes

logs-aws*

Additional requirements

Machine Learning

Platforms

AWS Cloudtrail

Tested ECS Version

1.6.0

Optional Info

https://www.linkedin.com/pulse/detecting-compromised-access-key-aws-guy-dahan

Query

based on ML job, score threshold 50

New fields required in ECS/data sources for this rule?

user_identity.accessKeyId

Example Data

[guyrdahan]

a short artical about this detection
https://www.linkedin.com/pulse/detecting-compromised-access-key-aws-guy-dahan

[botelastic]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[Mikaayenson]

cc. @pantea-elastic FYSA to include into future planning.