AWS IAM Virtual MFA Device Registration Attempt with Session Token

  1[metadata]
  2creation_date = "2025/04/11"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2025/11/03"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects attempts to create or enable a Virtual MFA device (CreateVirtualMFADevice, EnableMFADevice) using temporary AWS
 11credentials (access keys beginning with ASIA). Session credentials are short-lived and tied to existing authenticated
 12sessions, so using them to register or enable MFA devices is unusual. Adversaries who compromise temporary credentials
 13may abuse this behavior to establish persistence by attaching new MFA devices to maintain access to high-privilege
 14accounts despite key rotation or password resets.
 15"""
 16false_positives = [
 17    """
 18    Some legitimate administrative workflows or CI/CD automation pipelines may temporarily configure or re-enable MFA
 19    devices using session-based credentials. Validate the calling identity’s purpose, source IP, and user agent to
 20    confirm whether this activity was authorized. Additionally, when a user creates or enables a Virtual MFA device
 21    through the AWS Management Console, the underlying CloudTrail event will also show a temporary credential (access
 22    key ID beginning with ASIA), because the console itself issues short-lived STS session credentials for every
 23    logged-in user. These events are expected and should not be considered suspicious.
 24    """,
 25]
 26from = "now-6m"
 27index = ["filebeat-*", "logs-aws.cloudtrail-*"]
 28language = "eql"
 29license = "Elastic License v2"
 30name = "AWS IAM Virtual MFA Device Registration Attempt with Session Token"
 31note = """## Triage and Analysis
 32
 33> **Disclaimer**:
 34> This investigation guide was created using generative AI technology and validated for accuracy and relevance. Always
 35> tailor the steps to your organization's environment and operational context.
 36
 37### Investigating AWS IAM Virtual MFA Device Registration Attempt with Session Token
 38
 39Temporary credentials that start with the prefix `ASIA` are generated by the AWS Security Token Service (STS). These
 40session tokens are used for short-lived operations and should not be used to modify or register IAM
 41authentication mechanisms. This rule detects cases where an IAM user or role uses such temporary credentials to invoke either `CreateVirtualMFADevice` or `EnableMFADevice`.
 42
 43#### Possible investigation steps
 44
 45- **Identify the actor and session context**
 46  - Review `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.access_key_id` to determine the identity and confirm the `ASIA` prefix.  
 47  - If you ingest `event.original`, look for `sessionCredentialFromConsole: true` to determine if the temporary token is from a console login session (which uses temporary session tokens in the backend) rather than compromised session tokens.
 48  - Check `user_agent.original`, `source.ip`, and `cloud.region` to determine if this activity originated from an expected host, VPN, or location.
 49  - Cross-reference with prior activity by this identity—especially `GetSessionToken`, `AssumeRole`, or `GetCallerIdentity` calls.
 50
 51- **Correlate related IAM events**
 52  - Search for subsequent or preceding calls to:
 53    - `EnableMFADevice` (after `CreateVirtualMFADevice`)
 54    - `DeactivateMFADevice` or `DeleteVirtualMFADevice`
 55    - `ListMFADevices`, `ListUsers`, or `UpdateLoginProfile`
 56  - Review whether new MFA devices were successfully enabled (`event.outcome:success`).
 57
 58- **Assess session scope and privileges**
 59  - Identify what IAM policies are attached to the user or role that issued this request.  
 60  - If the temporary credentials were created via `AssumeRole` or `GetSessionToken`, check the originating principal’s permissions.
 61
 62- **Investigate possible persistence**
 63  - Look for new MFA devices listed for privileged users (e.g., account root or admin roles).  
 64  - Review login history for those accounts following the MFA change. 
 65
 66### False positive analysis
 67
 68- **Legitimate Administrative or Automated Actions**  
 69  Certain IAM administrative workflows or CI/CD automation tools may register or enable MFA devices using temporary
 70  session credentials. Confirm whether the calling principal is part of an authorized automation process or a known
 71  identity performing account configuration tasks.
 72
 73- **Expected Console Behavior**  
 74  When users create or enable Virtual MFA devices through the **AWS Management Console**, AWS automatically issues
 75  temporary STS credentials (with access key IDs beginning with `ASIA`) for that session. As a result, these events will
 76  appear identical to programmatic usage of session tokens in CloudTrail logs.  
 77  This is expected and does not indicate compromise.
 78
 79### Response and remediation
 80
 81- **Immediate containment**
 82  - Revoke or expire the temporary credentials (`aws sts revoke-session` if applicable).  
 83  - Disable or delete any newly created virtual MFA devices using `DeleteVirtualMFADevice`.  
 84  - Rotate passwords and long-term access keys for the associated IAM users.
 85
 86- **Investigation and scoping**
 87  - Review CloudTrail logs for related IAM modifications (`UpdateLoginProfile`, `AttachUserPolicy`, `CreateAccessKey`).  
 88  - Identify any new API keys or tokens created after the MFA registration.  
 89  - Cross-check whether the attacker leveraged the new MFA binding for session persistence or login.
 90
 91- **Recovery and hardening**
 92  - Enforce the `iam:EnableMFADevice` and `iam:CreateVirtualMFADevice` permissions only for trusted admin roles.  
 93  - Implement `aws:MultiFactorAuthPresent` conditions in IAM policies.  
 94  - Monitor for any future `ASIA` credential–based IAM configuration changes.
 95
 96### Additional information
 97- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)** 
 98- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)** 
 99- **[Managing MFA Devices in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html)** 
100"""
101references = ["https://www.sygnia.co/blog/sygnia-investigation-bybit-hack/"]
102risk_score = 47
103rule_id = "e4feea34-3b62-4c83-b77f-018fbef48c00"
104severity = "medium"
105tags = [
106    "Domain: Cloud",
107    "Data Source: AWS",
108    "Data Source: Amazon Web Services",
109    "Data Source: AWS CloudTrail",
110    "Data Source: AWS IAM",
111    "Tactic: Persistence",
112    "Use Case: Identity and Access Audit",
113    "Resources: Investigation Guide",
114]
115timestamp_override = "event.ingested"
116type = "eql"
117
118query = '''
119iam where event.dataset == "aws.cloudtrail"
120  and event.provider == "iam.amazonaws.com"
121  and event.outcome == "success"
122  and event.action in ("CreateVirtualMFADevice", "EnableMFADevice")
123  and startsWith (aws.cloudtrail.user_identity.access_key_id, "ASIA")
124'''
125
126
127[[rule.threat]]
128framework = "MITRE ATT&CK"
129[[rule.threat.technique]]
130id = "T1098"
131name = "Account Manipulation"
132reference = "https://attack.mitre.org/techniques/T1098/"
133[[rule.threat.technique.subtechnique]]
134id = "T1098.005"
135name = "Device Registration"
136reference = "https://attack.mitre.org/techniques/T1098/005/"
137
138
139[[rule.threat.technique]]
140id = "T1556"
141name = "Modify Authentication Process"
142reference = "https://attack.mitre.org/techniques/T1556/"
143[[rule.threat.technique.subtechnique]]
144id = "T1556.006"
145name = "Multi-Factor Authentication"
146reference = "https://attack.mitre.org/techniques/T1556/006/"
147
148
149
150[rule.threat.tactic]
151id = "TA0003"
152name = "Persistence"
153reference = "https://attack.mitre.org/tactics/TA0003/"
154
155[rule.investigation_fields]
156field_names = [
157    "@timestamp",
158    "user.name",
159    "user_agent.original",
160    "source.ip",
161    "aws.cloudtrail.user_identity.arn",
162    "aws.cloudtrail.user_identity.type",
163    "aws.cloudtrail.user_identity.access_key_id",
164    "event.action",
165    "event.outcome",
166    "cloud.account.id",
167    "cloud.region",
168    "aws.cloudtrail.request_parameters",
169    "aws.cloudtrail.response_elements",
170]