Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

ASL AWS Credential Access GetPasswordData

The following analytic identifiesGetPasswordData API calls in your AWS account. It leverages CloudTrail logs from Amazon Security Lake to detect this activity by counting the distinct instance IDs accessed. This behavior is significant as it may indicate an attempt to retrieve encrypted administrator passwords for running Windows instances, which is a critical security concern. If confirmed malicious, attackers could gain unauthorized access to administrative credentials, potentially leading to full control over the affected instances and further compromise of the AWS environment.

ATT&CK coverage

Outside the enterprise matrix

Detection requirements

Log source category: asl_aws_cloudtrail

What the source says

What fires this without an attack behind it

Administrator tooling or automated scripts may make these calls but it is highly unlikely to make several calls in a short period of time.

References

Tagged by the source as

AWS Identity and Access Management Account TakeoverAWS AccountcloudSplunk CloudSplunk EnterpriseSplunk Enterprise Securitythreat

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.