Skip to content

Previously Inactive Token Is Now Active Again

Description

When a token that has been inactive for a period of time becomes active again, it could potentially pose a security threat to your organization.

It's important to be aware of this and take the necessary precautions to ensure that token activity is legitimate.

Detection triggers

  • Inactive (idle) token status is switched to "active" (used).

  • Token is becoming Idle after not being used for X days - 30 by default, however, this configuration of "Idle" can be set on Liminal's risks settings.

  • The token must be enabled.

Mitigation

Inactive tokens becoming active again after a long time is considered an anomaly.

Review this activity by following these steps:

  1. Review the "activity" tab to check its activity for the following behavior.

    • Is his new activity aligned with his previous one, or is it used to perform new actions?

    • Is the workload IP and client identical to its previous usage?

  2. Investigate the actor's identity, to understand if it's legitimate and expected.

    • If legitimate, move this risk status to 'approved'.

    • Otherwise, consider revoking the token and investigating the actors.

JSON Example

Risk JSON

account: {environment: "dev", environmentType: "DEV"}
accountId: "120768082511"
accountType: "AWS"
category: "ABNORMAL_BEHAVIOR"
correlationGuid: "NTR-127315"
creationDate: "2024-09-11T07:30:11.599Z"
customData: null
customerId: 34
data: {awsLogs: [{tags: ["Human", "CLI"], eventId: "f4564d9b-7b73-4aa3-a51a-c4503254e2b6",…}],…}
description: "When a token that has been inactive for a period of time becomes active again, it could potentially pose a security threat to your organization. It's important to be aware of this and take the necessary precautions to ensure that token activity is legitimate."
destination: "AWS_IAM_ACCESS_KEY"
guid: "RSK-8444"
hasComment: null
hasJiraTicket: null
hasSeen: false
hasSlackMessage: null
id: 37456
isArchived: false
key: "USER_REVIVED-TKN-590"
linkedElements: ["TKN-590"]
logChangeType: null
modifyDate: "2024-09-11T07:30:11.599Z"
name: "Previously inactive token is now active again"
occurrences: ["AWS_IAM_ACCESS_KEY"]
owner: "e6ac4cd7-8615-460a-b0d0-fdc882b09ce1"
ownerAiObject: null
ownerUid: null
path: "AKIARYHSWWJH72RRK6TG"
ruleCode: "TOKEN_NOT_USED_TO_USED"
scanId: 1407038
severity: "MEDIUM"
source: "AWS"
status: "OPEN"
tags: ["Abnormal Behavior", "Human", "CLI", "dev"]
tasks: [{customerId: 34, riskId: 37456, type: "REVOKE_TOKEN_AFTER_ACTIVITY", level: "HARD",…}]
type: "USER_REVIVED"

Linked Element (NHI Token) JSON

accessedDate: "2024-09-25T12:39:00.000Z"
account: {environment: "dev", environmentType: "DEV", accountType: "AWS", id: "120768082511"}
accountId: "120768082511"
accountType: "AWS"
awsPolicies: {policies: [,…],…}
azurePermissions: null
azureRoles: null
correlationGuid: "NTR-127315"
creationDate: "2023-12-03T11:15:23.000Z"
creator: null
customerId: 34
devices: [{role: "e6ac4cd7-8615-460a-b0d0-fdc882b09ce1", region: "us-east-1", ipAddress: "80.179.89.117",…}]
guid: "TKN-590"
infoJSON: "{\"serviceName\":\"sts\",\"region\":\"us-east-1\",\"userArn\":\"arn:aws:iam::120768082511:user/e6ac4cd7-8615-460a-b0d0-fdc882b09ce1\"}"
isActive: true
isAdmin: false
isArchived: false
isIdle: false
isProd: false
lastAccessors: [,…]
lastModifiers: []
lastOwnerAiUpdate: null
liminalCreationDate: "2024-05-22T09:40:43.391Z"
liminalModifyDate: "2024-10-29T09:39:21.731Z"
originAccessMethod: "AWS_IAM_ACCESS_KEY"
owner: "e6ac4cd7-8615-460a-b0d0-fdc882b09ce1"
ownerAiObject: {similarity: 1, ownerItemType: "email", elementItemType: "username",…}
ownerSource: null
ownerUid: "904094ca-3371-440c-8b86-a84b01ab8ff4"
riskSeverity: "MEDIUM"
rotationDate: "2023-12-03T11:15:23.000Z"
scanId: 2802497
serviceName: "sts"
status: "Active"
tags: {tags: ["Human", "CLI"]}
tokenId: "AKIARYHSWWJH72RRK6TG"
tokenTotalAccess: 485
tokenTotalIp: 4
tokenTotalUserAgent: 20
uid: "0d5d78b6-1e7a-449a-8772-08d72b00fe1b"
userAgent: "aws-cli/2.9.1 Python/3.9.11 Darwin/23.6.0 exe/x86_64 prompt/off command/sts.get-caller-identity"
username: "e6ac4cd7-8615-460a-b0d0-fdc882b09ce1"