cyber.hendryadrian.com
Detection & Defense · wazuh.com

How to Detect AWS Access Key Compromise with Wazuh

· Original article ↗

Summary

A hands-on guide configures Wazuh to ingest AWS CloudTrail and GuardDuty logs, correlate suspicious access-key activity, and alert on validation, enumeration, persistence, and exfiltration signals.

Key points

  • The guide uses CloudTrail API events and GuardDuty findings, exported to S3, as telemetry for detecting suspected compromised AWS access keys.
  • Wazuh rules flag key validation from untrusted IPs, repeated AccessDenied errors, suspicious credential or user creation attempts, and GuardDuty exfiltration or anomalous-behavior findings.
  • Correlation rules alert when validation and persistence activity match the same IAM identity within 900 seconds, regardless of event processing order.
  • The demonstration emulates validation, permission probing, and a denied attempt to create a backup access key; it uses a GuardDuty sample finding to test ingestion and rule matching.
  • The article notes that S3 interval polling can miss out-of-order delivery files and recommends SQS-based CloudTrail collection where detection completeness matters.
  • Recommended protections include replacing long-lived keys with short-lived credentials, restricting credential use by network, scanning for exposed secrets, and quarantining compromised keys.

Article Details

Defense Focus
Detect AWS access key compromise by correlating CloudTrail API activity with GuardDuty findings to identify a compromise chain and alert security teams.
Detection Methods
  • Flag sts:GetCallerIdentity and sts:GetSessionToken calls from source IP addresses absent from the trusted-IP list, excluding listed service identities.
  • Detect six or more AccessDenied events from the same IAM identity within 900 seconds as possible permission enumeration.
  • Flag CreateAccessKey, CreateUser, or AttachUserPolicy calls from untrusted IP addresses by identities absent from the service-identity list; the rule alerts even when the operation is denied.
  • Match GuardDuty findings for credential exfiltration or anomalous behavior.
  • Correlate validation and persistence events for the same IAM identity in either processing order within 900 seconds.
Data Sources
  • AWS CloudTrail management events, including source IP, IAM identity, API event name, and AccessDenied errors.
  • Amazon GuardDuty findings exported to Amazon S3, including credential-exfiltration and anomalous-behavior findings.
Rule Types
  • Custom Wazuh XML rules using event-field matching and exact-match CDB lists for trusted IP addresses and excluded service identities.
  • Frequency-and-timeframe rule for repeated AccessDenied events.
  • Same-identity correlation rules with a 900-second window that support either event-processing order.
Platforms
  • Centralized deployment with server, indexer, and dashboard components.
Defensive Actions
  • Prefer IAM roles and short-lived credentials over long-term access keys.
  • Use the Wazuh AWS module's SQS-based CloudTrail collection where detection completeness matters; interval polling can miss out-of-order delivery files.
  • Use a service control policy or resource control policy to restrict credential use to corporate CIDR ranges or expected VPCs.
  • Enable CloudTrail log-file integrity validation and restrict access to the log bucket.
  • Rotate access keys and scan repositories and CI/CD configuration for committed secrets.
  • Keep trusted-IP and service-identity lists current as egress addresses and service identities change.
  • Use AWSCompromisedKeyQuarantineV2 to automatically deactivate a stolen access key.
  • Enable IAM Access Analyzer and enforce least privilege.

MITRE ATT&CK

T1069.003 · Cloud GroupsThe article maps the IAM permission-enumeration stage to permission-groups discovery in cloud environments.T1078.004 · Cloud AccountsThe detection rules map validation of a potentially stolen access key through AWS identity or session-token API calls to this technique.T1087.004 · Cloud AccountThe enumeration rule maps repeated AccessDenied activity by one IAM identity to cloud account discovery.T1098.001 · Additional Cloud CredentialsThe persistence rules map attempts to create additional access keys, create users, or attach user policies to this technique.T1552 · Unsecured CredentialsThe GuardDuty rule maps credential-exfiltration or anomalous-behavior findings to this ID; the sample finding tests rule matching, not GuardDuty's underlying detection.T1580 · Cloud Infrastructure DiscoveryThe article maps repeated permission-probing activity to cloud infrastructure discovery.

Vendors

Amazon Web ServicesAWS access keys are credentials that applications, users, and automation tools use to authenticate to AWS services through APIs.WazuhWazuh collects this telemetry through its AWS module, decodes it, and evaluates it against detection rules.

Products

Amazon EC2Wazuh 4.14.7 central components installed on an Amazon EC2 Ubuntu 24 instance.Amazon GuardDutyAWS CloudTrail records API activity, while Amazon GuardDuty identifies suspicious behavior involving AWS resources and credentials.Amazon S3AWS KMS: AWS Key Management Service (KMS) encrypts the GuardDuty findings written to Amazon S3.AWS CLIWe emulate a compromise chain from the Ubuntu endpoint using the AWS CLI, targeting a public IP address that falls outside trusted_aws_ips.AWS CloudTrailAWS CloudTrail records API activity, while Amazon GuardDuty identifies suspicious behavior involving AWS resources and credentials.AWS KMSAWS KMS: AWS Key Management Service (KMS) encrypts the GuardDuty findings written to Amazon S3.IAM Access AnalyzerEnable IAM Access Analyzer to identify excessive permissions and unintended access, helping enforce least privilege across IAM identities and resources.WazuhWazuh collects this telemetry through its AWS module, decodes it, and evaluates it against detection rules.

Related Articles