AWS Cloud Trail AWS IAM User Created

Query

let _AWSAccounts =
    _GetWatchlist("AccountId-AuditAWSAccounts")
    | project AccountId, AccountName, Auditors = Auditor, AlertSeverity = Severity, Notes
;
AWSCloudTrail
| where EventName has "CreateUser" and not(EventSource == "sso-directory.amazonaws.com")// and EventSource == "iam.amazonaws.com"
| extend CreatedUserName = tostring(todynamic(RequestParameters)["userName"])
| lookup kind=leftouter (
    _AWSAccounts
    | project-rename RecipientAccountName = AccountName
    ) on $left.RecipientAccountId == $right.AccountId
//| where Notes has "[CreateUser]" or isempty(RecipientAccountName)
| lookup kind=leftouter (
    _AWSAccounts
    | project UserIdentityAccountName = AccountName, AccountId
    ) on $left.UserIdentityAccountId == $right.AccountId
| extend AlertDescription = strcat(
    'This rule detects the creation of a user in AWS accounts using means different than IAM Identity Center, which should be the one used for this task.\n\nIn the AWS account "',
    iff(isnotempty(RecipientAccountName), RecipientAccountName, RecipientAccountId),
    '" ',
    case(
        UserIdentityType == "Root", "the root user",
        UserIdentityType == "AssumedRole", strcat('the user "', tostring(split(UserIdentityPrincipalid, ":")[1]), '", assuming the role "', tostring(split(UserIdentityArn, "/")[-2]), '",'),
        UserIdentityType == "IAM", strcat('the IAM user "', UserIdentityUserName),
        "an unknown user"
    ),
    iff(isnotempty(ErrorCode) or isnotempty(ErrorMessage), " failed to create", " created"),
    ' a user called "',
    CreatedUserName,
    '"',
    iff(not(SourceIpAddress has ".amazonaws.com"), strcat(", from the IP address ", SourceIpAddress), ""),
    ".\n"
    )
| project
    TimeGenerated,
    UserIdentityType,
    UserIdentityAccountName,
    UserIdentityAccountId,
    SessionCreationDate,
    SessionIssuerUserName,
    SessionIssuerPrincipalId,
    SessionIssuerArn,
    UserIdentityUserName,
    UserIdentityPrincipalid,
    UserIdentityArn,
    UserIdentityAccessKeyId,
    RecipientAccountId,
    RecipientAccountName,
    AWSRegion,
    SourceIpAddress,
    EventSource,
    EventTypeName,
    EventName,
    ManagementEvent,
    ReadOnly,
    ErrorCode,
    ErrorMessage,
    CreatedUserName,
    RequestParameters,
    ResponseElements,
    Resources,
    SessionMfaAuthenticated,
    UserAgent,
    AwsEventId,
    AlertSeverity,
    AlertDescription,
    Auditors

Explanation

This KQL query is designed to detect and provide details about the creation of new users in AWS accounts, specifically when the creation is done through methods other than the IAM Identity Center. Here's a simplified breakdown:

Watchlist Retrieval: The query starts by retrieving a watchlist named "AccountId-AuditAWSAccounts" which contains information about AWS accounts, including their IDs, names, associated auditors, alert severity, and any notes.
Event Filtering: It filters events from the AWSCloudTrail where the event name is "CreateUser" and the event source is not "sso-directory.amazonaws.com". This means it looks for user creation events that did not occur through the IAM Identity Center.
User Name Extraction: The query extracts the name of the created user from the request parameters.
Account Information Lookup: It performs two left outer joins with the watchlist data:
- First, to get the recipient account's name based on the account ID.
- Second, to get the user identity account's name and ID.
Alert Description Construction: It constructs a detailed alert description that explains the context of the user creation event, including:
- The AWS account where the user was created.
- The type of user identity that performed the action (e.g., root user, IAM user, assumed role).
- Whether the user creation was successful or failed.
- The IP address from which the request originated, if applicable.
Data Projection: Finally, it selects and outputs a variety of relevant fields, such as the time of the event, user identity details, account information, event specifics, and the constructed alert description.

Overall, this query helps in auditing and monitoring user creation activities in AWS accounts, ensuring they align with expected practices and identifying any anomalies or unauthorized actions.

Details

Jose Sebastián Canós

Released: March 11, 2024

Tables

AWSCloudTrail

Keywords

AWSAccountsAWSCloudTrailEventNameEventSourceCreatedUserNameRecipientAccountNameUserIdentityAccountNameAlertDescriptionUserIdentityTypeUserIdentityPrincipalidUserIdentityArnUserIdentityUserNameErrorCodeErrorMessageSourceIpAddressTimeGeneratedUserIdentityAccountIdSessionCreationDateSessionIssuerUserNameSessionIssuerPrincipalIdSessionIssuerArnUserIdentityAccessKeyIdRecipientAccountIdAWSRegionEventTypeNameManagementEventReadOnlyRequestParametersResponseElementsResourcesSessionMfaAuthenticatedUserAgentAwsEventIdAlertSeverityAuditors

Operators

letprojecthasnotextendtostringtodynamiclookupproject-renameoniffisnotemptycasesplitstrcatorisempty

Actions

GitHub

KQL Search