NHI Token Used by Multiple Devices

Description

NHI Token is being used by multiple different devices. This could indicate potential misuse, bad practice of token sharing, or potential exploitation as tokens are originated to be used by a single application.

Severity should increase depending on type and amount of unique devices.

Detection triggers

Production NHI Token is being used from 2 'unique' IP-Addresses, User-agents.
Non-Production NHI Token will only trigger this detection if being used from 4 'unique' IP-Addresses, User-agents.

Mitigation

Overused NHI Token to be reviewed

SailPoint Entro observed multiple consumers (devices) of the same NHI Token, which could indicate token misuse or potential exploitation by unwanted adversaries.

To eliminate scenarios of token exploitation, please follow these steps:

Conduct a detailed review of device information, including user-agent, geolocation, and IP addresses, to verify the legitimacy of consumers.
Collaborate with the NHI Token owner to investigate instances of token overuse and seek appropriate justification.
Consider revoking tokens that show signs of potential misuse.
Educate engineers on the importance of securely managing NHI Tokens, emphasizing their intended use only.
Generate distinct tokens for individual consumers as needed.

JSON Example

Risk JSON

account: {environment: "dev", environmentType: "DEV"}
accountId: "120768082511"
accountType: "AWS"
category: "ABNORMAL_BEHAVIOR"
correlationGuid: null
creationDate: "2024-09-25T23:00:47.569Z"
customData: [{label: "NHI Token", value: "AKIARWNGDZ7F5PQK7GFW (shak@entro.security)"},…]
customerId: 34
data: {source: "DEVICE", uniqueOSCount: 3, countriesCount: 3,…}
description: "This could indicate potential misuse, bad practice of token sharing, or potential exploitation."
destination: "AWS_IAM_ACCESS_KEY"
guid: "RSK-8737"
hasComment: null
hasJiraTicket: null
hasSeen: false
hasSlackMessage: null
id: 41053
isArchived: false
key: "DEVICES-MANY_DEVICES_USE_TOKEN-TKN-1826"
linkedElements: ["TKN-1826"]
logChangeType: null
modifyDate: "2024-10-28T23:04:11.774Z"
name: "AWS NHI token in dev is used by multiple devices"
occurrences: []
owner: "shaked.rosen"
ownerAiObject: {similarity: 1, ownerItemType: "email", elementItemType: "username",…}
ownerUid: "904094ca-3371-440c-8b86-a84b01ab8ff4"
path: "AKIARWNGDZ7F5PBNIRCX"
ruleCode: "MANY_DEVICES_USE_TOKEN"
scanId: 2916210
severity: "LOW"
source: "DEVICE"
status: "OPEN"
tags: ["Anomaly", "Devices", "dev"]
tasks: [{customerId: 34, riskId: 41053, type: "OVERUSED_NHI", level: "MEDIUM",…}]
type: "DEVICES"

Linked Element (NHI Token) JSON

accessedDate: "2024-08-11T14:37:00.000Z"
account: {environment: "dev", environmentType: "DEV", accountType: "AWS", id: "120768082511"}
accountId: "120768082511"
accountType: "AWS"
correlationGuid: null
creationDate: "2024-07-30T11:13:25.000Z"
creator: {eventId: "a09d49e9-c802-4ede-bac3-7f4a2caee5bc", username: "shak@entro.security",…}
customerId: 34
devices: [{role: "83e9509f-a859-4d3d-a951-1be858681806", region: "us-east-1", ipAddress: "54.88.233.5",…},{role: "83e9509f-a859-4d3d-a951-1be858681806", region: "us-east-1", ipAddress: "44.204.17.152",…},{role: "83e9509f-a859-4d3d-a951-1be858681806", region: "us-east-1", ipAddress: "3.87.36.85",…},{role: "83e9509f-a859-4d3d-a951-1be858681806", region: "us-east-1", ipAddress: "3.92.216.69",…},{role: "83e9509f-a859-4d3d-a951-1be858681806", region: "us-east-1", ipAddress: "44.204.174.243",…},…]
guid: "TKN-1826"
infoJSON: "{\"serviceName\":\"ecs\",\"region\":\"us-east-1\",\"userArn\":\"arn:aws:iam::116849364939:user/sus_boi\"}"
isActive: true
isAdmin: false
isArchived: true
isIdle: false
isProd: false
lastAccessors: []
lastModifiers: []
lastOwnerAiUpdate: null
liminalCreationDate: "2024-09-25T18:41:09.215Z"
liminalModifyDate: "2024-09-27T13:46:24.960Z"
originAccessMethod: "AWS_IAM_ACCESS_KEY"
owner: "shaked.rosen@entro.security"
ownerAiObject: {similarity: 1, ownerItemType: "email", elementItemType: "username",…}
ownerSource: null
ownerUid: "904094ca-3371-440c-8b86-a84b01ab8ff4"
riskSeverity: "LOW"
rotationDate: "2024-07-30T11:13:25.000Z"
scanId: 1840417
serviceName: "ecs"
status: "Deleted"
tags: {tags: []}
tokenId: "AKIARWNGDZ7F5PBNIRCX"
tokenTotalAccess: 1
tokenTotalIp: 1
tokenTotalUserAgent: 1
uid: "0c8794c3-9611-4d8d-a977-7788c16db8cf"
userAgent: null
username: "sus_boi"