[New Rule] Adding Coverage for AWS IAM Virtual MFA Device Registration (#4626)

* adding new rule 'AWS IAM Virtual MFA Device Registration Attempt with Session Token'

* updating rule

---------

Co-authored-by: Colson Wilhoit <[email protected]>

Author: terrancedejesus

rules/integrations/aws/persistence_aws_attempt_to_register_virtual_mfa_device.toml

@@ -0,0 +1,92 @@
+[metadata]
+creation_date = "2025/04/11"
+integration = ["aws"]
+maturity = "production"
+updated_date = "2025/04/15"
+
+[rule]
+author = ["Elastic"]
+description = """
+Identifies attempts to register or enable an IAM Virtual MFA device using temporary credentials (access keys
+starting with 'ASIA'). This may indicate an adversary attempting to escalate privileges or establish persistence using
+stolen session tokens.
+"""
+false_positives = [
+    """
+    Legitimate users or automation tools may register MFA devices using temporary session credentials, especially in
+    CI/CD or administrative workflows. Validate the source IP, user agent, and context of the registration.
+    """,
+]
+from = "now-9m"
+index = ["filebeat-*", "logs-aws.cloudtrail-*"]
+language = "kuery"
+license = "Elastic License v2"
+name = "AWS IAM Virtual MFA Device Registration Attempt with Session Token"
+note = """## Triage and Analysis
+
+### Investigating AWS IAM Virtual MFA Device Registration Attempt with Session Token
+
+AWS temporary security credentials that begin with `ASIA` indicate they are session tokens. An attempt to create or enable a Virtual MFA device using such credentials is uncommon and may indicate malicious activity.
+
+#### Possible Investigation Steps
+
+- **Identify the User**: Check `user.name`, `user.arn`, and `aws.cloudtrail.user_identity.*` fields to determine which IAM entity made the request.
+- **Check for Prior Reconnaissance or Access**: Correlate this event with any prior calls to `GetSessionToken`, `GetCallerIdentity`, or `ListUsers` to see if an adversary was enumerating IAM users.
+- **Source Context**: Review `source.ip`, `user_agent`, and `event.origin` to determine whether this came from a legitimate device or a suspicious endpoint (e.g., Kali, Mythic, unknown VPN).
+- **Validate MFA Setup**: Look for follow-up attempts to call `sts:get-session-token` or `iam:EnableMFADevice` using this same session.
+
+### False Positive Analysis
+
+- This may occur if an admin or automation tool is legitimately setting up a new MFA device using temporary credentials.
+- Review the IP, agent, and context to differentiate expected automation from unauthorized access.
+
+### Response and Remediation
+
+- **Revoke Credentials**: If unauthorized, revoke the access keys or terminate the session.
+- **Reset MFA and Passwords**: Rotate credentials for the affected IAM user.
+- **Review IAM Policies**: Limit permissions to register MFA devices to trusted roles only.
+- **Enable CloudTrail Alerts**: Monitor IAM changes more broadly with CloudTrail-based alerts.
+"""
+references = ["https://www.sygnia.co/blog/sygnia-investigation-bybit-hack/"]
+risk_score = 47
+rule_id = "e4feea34-3b62-4c83-b77f-018fbef48c00"
+severity = "medium"
+tags = [
+    "Domain: Cloud",
+    "Data Source: AWS",
+    "Data Source: Amazon Web Services",
+    "Data Source: AWS CloudTrail",
+    "Data Source: AWS IAM",
+    "Tactic: Persistence",
+    "Use Case: Identity and Access Audit",
+    "Resources: Investigation Guide",
+]
+timestamp_override = "event.ingested"
+type = "query"
+
+query = '''
+event.dataset: "aws.cloudtrail"
+  and event.provider: "iam.amazonaws.com"
+  and event.action: ("CreateVirtualMFADevice" or "EnableMFADevice")
+  and aws.cloudtrail.user_identity.access_key_id: ASIA*
+'''
+
+
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+[[rule.threat.technique]]
+id = "T1098"
+name = "Account Manipulation"
+reference = "https://attack.mitre.org/techniques/T1098/"
+[[rule.threat.technique.subtechnique]]
+id = "T1098.005"
+name = "Device Registration"
+reference = "https://attack.mitre.org/techniques/T1098/005/"
+
+
+
+[rule.threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+