Skip to content

Commit 5162067

Browse files
terrancedejesusterrancedejesus
authored
[New Rule] Adding Coverage for Unusual AWS S3 Object Encryption with SSE-C (#4377)
* new rule 'Unusual AWS S3 Object Encryption with SSE-C' * updated pyproject patch version * bump repo version * Update rules/integrations/aws/impact_s3_unusual_object_encryption_with_sse_c.toml * updating patch version * updating patch version * Adding additional threshold rule
1 parent c04ae6d commit 5162067

File tree

4 files changed

+284
-1
lines changed

4 files changed

+284
-1
lines changed

‎detection_rules/etc/non-ecs-schema.json‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,6 +158,10 @@
158158
"aws.cloudtrail.flattened.request_parameters.roleName": "keyword",
159159
"aws.cloudtrail.flattened.request_parameters.policyArn": "keyword",
160160
"aws.cloudtrail.flattened.request_parameters.serialNumber": "keyword",
161+
"aws.cloudtrail.flattened.request_parameters.x-amz-server-side-encryption-customer-algorithm": "keyword",
162+
"aws.cloudtrail.flattened.additional_eventdata.SSEApplied": "keyword",
163+
"aws.cloudtrail.flattened.request_parameters.bucketName": "keyword",
164+
"aws.cloudtrail.flattened.request_parameters.key": "keyword",
161165
"aws.cloudtrail.flattened.request_parameters.includeDeprecated": "keyword"
162166
},
163167
"logs-azure.signinlogs-*": {

‎pyproject.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[project]
22
name = "detection_rules"
3-
version = "0.3.18"
3+
version = "0.3.19"
44
description = "Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine."
55
readme = "README.md"
66
requires-python = ">=3.12"

‎rules/integrations/aws/impact_s3_excessive_object_encryption_with_sse_c.toml‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
[metadata]
2+
creation_date = "2025/01/15"
3+
integration = ["aws"]
4+
maturity = "production"
5+
updated_date = "2025/01/15"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
Identifies a high-volume of AWS S3 objects stored in a bucket using using Server-Side Encryption with Customer-Provided Keys
11+
(SSE-C). Adversaries with compromised AWS credentials can encrypt objects in an S3 bucket using their own encryption
12+
keys, rendering the objects unreadable or recoverable without the key. This can be used as a form of ransomware to
13+
extort the bucket owner for the decryption key. This is a [Threshold](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-threshold-rule) rule that flags when
14+
this behavior is observed for a specific bucket more than 15 times in a short time-window.
15+
"""
16+
false_positives = [
17+
"""
18+
Legitimate use of Server-Side Encryption with Customer-Provided Keys (SSE-C) to encrypt objects in an S3 bucket.
19+
""",
20+
]
21+
from = "now-9m"
22+
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
23+
language = "kuery"
24+
license = "Elastic License v2"
25+
name = "Excessive AWS S3 Object Encryption with SSE-C"
26+
note = """### Triage and Analysis
27+
28+
#### Investigating Excessive AWS S3 Object Encryption with SSE-C
29+
This rule identifies a high volume of objects being encrypted using Server-Side Encryption with Customer-Provided Keys (SSE-C) in AWS S3. This could indicate malicious activity, such as ransomware encrypting objects, rendering them inaccessible without the corresponding encryption keys.
30+
31+
##### Possible Investigation Steps
32+
33+
1. **Identify the User and Source**:
34+
- Review the `aws.cloudtrail.user_identity.arn` to identify the IAM user or role performing the operation.
35+
- Cross-check the `source.ip` and `user_agent.original` fields for unusual IPs or user agents that could indicate unauthorized access.
36+
- Review the `aws.cloudtrail.user_identity.access_key_id` to identify the access key used. This could be a compromised key.
37+
38+
2. **Examine the Targeted Resources**:
39+
- Check `aws.cloudtrail.flattened.request_parameters.bucketName` to identify the bucket involved.
40+
- Analyze the object key from `aws.cloudtrail.flattened.request_parameters.key`.
41+
42+
3. **Evaluate Encryption Behavior**:
43+
- Confirm the encryption details in `aws.cloudtrail.flattened.request_parameters.x-amz-server-side-encryption-customer-algorithm` and `aws.cloudtrail.flattened.additional_eventdata.SSEApplied`.
44+
- Note if `SSEApplied` is `SSE-C`, which confirms encryption using a customer-provided key.
45+
46+
4. **Correlate with Recent Events**:
47+
- Look for any suspicious activity in proximity to the encryption event, such as new access key creation, policy changes, or unusual access patterns from the same user or IP.
48+
- Identify `ListBucket` or `GetObject` operations on the same bucket to determine all affected objects.
49+
- For `PutObject` events, identify any other unusual objecs uploaded such as a ransom note.
50+
51+
5. **Validate Access Permissions**:
52+
- Check the IAM policies and roles associated with the user to verify if they had legitimate access to encrypt objects.
53+
54+
6. **Assess Impact**:
55+
- Identify the number of encrypted objects in the bucket by examining other similar events.
56+
- Determine if this encryption aligns with standard business practices or constitutes a deviation.
57+
58+
### False Positive Analysis
59+
60+
- **Legitimate Use Cases**:
61+
- Confirm if SSE-C encryption is part of regular operations for compliance or data protection.
62+
- Cross-reference known processes or users authorized for SSE-C encryption in the affected bucket.
63+
64+
### Response and Remediation
65+
66+
1. **Immediate Actions**:
67+
- Disable access keys or permissions for the user if unauthorized behavior is confirmed.
68+
- Rotate the bucket's encryption configuration to mitigate further misuse.
69+
70+
2. **Data Recovery**:
71+
- Attempt to identify and contact the party holding the SSE-C encryption keys if recovery is necessary.
72+
73+
3. **Enhance Monitoring**:
74+
- Enable alerts for future SSE-C encryption attempts in critical buckets.
75+
- Review and tighten IAM policies for roles and users accessing S3.
76+
77+
4. **Post-Incident Review**:
78+
- Audit logs for additional activities by the same user or IP.
79+
- Document findings and apply lessons learned to improve preventive measures.
80+
"""
81+
references = [
82+
"https://www.halcyon.ai/blog/abusing-aws-native-services-ransomware-encrypting-s3-buckets-with-sse-c",
83+
"https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerSideEncryptionCustomerKeys.html",
84+
]
85+
risk_score = 73
86+
rule_id = "909bf7c8-d371-11ef-bcc3-f661ea17fbcd"
87+
setup = "AWS S3 data event types need to be enabled in the CloudTrail trail configuration."
88+
severity = "high"
89+
tags = [
90+
"Domain: Cloud",
91+
"Data Source: AWS",
92+
"Data Source: Amazon Web Services",
93+
"Data Source: AWS S3",
94+
"Resources: Investigation Guide",
95+
"Use Case: Threat Detection",
96+
"Tactic: Impact",
97+
]
98+
timestamp_override = "event.ingested"
99+
type = "threshold"
100+
101+
query = '''
102+
event.dataset: "aws.cloudtrail"
103+
and event.provider: "s3.amazonaws.com"
104+
and event.action: "PutObject"
105+
and event.outcome: "success"
106+
and aws.cloudtrail.flattened.request_parameters.x-amz-server-side-encryption-customer-algorithm: "AES256"
107+
and aws.cloudtrail.flattened.additional_eventdata.SSEApplied: "SSE_C"
108+
'''
109+
110+
111+
[[rule.threat]]
112+
framework = "MITRE ATT&CK"
113+
[[rule.threat.technique]]
114+
id = "T1486"
115+
name = "Data Encrypted for Impact"
116+
reference = "https://attack.mitre.org/techniques/T1486/"
117+
118+
119+
[rule.threat.tactic]
120+
id = "TA0040"
121+
name = "Impact"
122+
reference = "https://attack.mitre.org/tactics/TA0040/"
123+
124+
[rule.threshold]
125+
field = ["aws.cloudtrail.flattened.request_parameters.bucketName"]
126+
value = 20
127+
128+

‎rules/integrations/aws/impact_s3_unusual_object_encryption_with_sse_c.toml‎

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
[metadata]
2+
creation_date = "2025/01/15"
3+
integration = ["aws"]
4+
maturity = "production"
5+
updated_date = "2025/01/15"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
Identifies when AWS S3 objects stored in a bucket are encrypted using Server-Side Encryption with Customer-Provided Keys
11+
(SSE-C). Adversaries with compromised AWS credentials can encrypt objects in an S3 bucket using their own encryption
12+
keys, rendering the objects unreadable or recoverable without the key. This can be used as a form of ransomware to
13+
extort the bucket owner for the decryption key. This is a [New
14+
Terms](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-new-terms-rule) rule that flags when
15+
this behavior is observed for the first time in the last 14 days by the user ARN and target bucket name.
16+
"""
17+
false_positives = [
18+
"""
19+
Legitimate use of Server-Side Encryption with Customer-Provided Keys (SSE-C) to encrypt objects in an S3 bucket.
20+
""",
21+
]
22+
from = "now-9m"
23+
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
24+
language = "kuery"
25+
license = "Elastic License v2"
26+
name = "Unusual AWS S3 Object Encryption with SSE-C"
27+
note = """### Triage and Analysis
28+
29+
#### Investigating Unusual AWS S3 Object Encryption with SSE-C
30+
This rule identifies the use of Server-Side Encryption with Customer-Provided Keys (SSE-C) in AWS S3. This could indicate malicious activity, such as ransomware encrypting objects, rendering them inaccessible without the corresponding encryption keys.
31+
32+
##### Possible Investigation Steps
33+
34+
1. **Identify the User and Source**:
35+
- Review the `aws.cloudtrail.user_identity.arn` to identify the IAM user or role performing the operation.
36+
- Cross-check the `source.ip` and `user_agent.original` fields for unusual IPs or user agents that could indicate unauthorized access.
37+
- Review the `aws.cloudtrail.user_identity.access_key_id` to identify the access key used. This could be a compromised key.
38+
39+
2. **Examine the Targeted Resources**:
40+
- Check `aws.cloudtrail.flattened.request_parameters.bucketName` to identify the bucket involved.
41+
- Analyze the object key from `aws.cloudtrail.flattened.request_parameters.key`.
42+
43+
3. **Evaluate Encryption Behavior**:
44+
- Confirm the encryption details in `aws.cloudtrail.flattened.request_parameters.x-amz-server-side-encryption-customer-algorithm` and `aws.cloudtrail.flattened.additional_eventdata.SSEApplied`.
45+
- Note if `SSEApplied` is `SSE-C`, which confirms encryption using a customer-provided key.
46+
47+
4. **Correlate with Recent Events**:
48+
- Look for any suspicious activity in proximity to the encryption event, such as new access key creation, policy changes, or unusual access patterns from the same user or IP.
49+
- Identify `ListBucket` or `GetObject` operations on the same bucket to determine all affected objects.
50+
- For `PutObject` events, identify any other unusual objecs uploaded such as a ransom note.
51+
52+
5. **Validate Access Permissions**:
53+
- Check the IAM policies and roles associated with the user to verify if they had legitimate access to encrypt objects.
54+
55+
6. **Assess Impact**:
56+
- Identify the number of encrypted objects in the bucket by examining other similar events.
57+
- Determine if this encryption aligns with standard business practices or constitutes a deviation.
58+
59+
### False Positive Analysis
60+
61+
- **Legitimate Use Cases**:
62+
- Confirm if SSE-C encryption is part of regular operations for compliance or data protection.
63+
- Cross-reference known processes or users authorized for SSE-C encryption in the affected bucket.
64+
65+
### Response and Remediation
66+
67+
1. **Immediate Actions**:
68+
- Disable access keys or permissions for the user if unauthorized behavior is confirmed.
69+
- Rotate the bucket's encryption configuration to mitigate further misuse.
70+
71+
2. **Data Recovery**:
72+
- Attempt to identify and contact the party holding the SSE-C encryption keys if recovery is necessary.
73+
74+
3. **Enhance Monitoring**:
75+
- Enable alerts for future SSE-C encryption attempts in critical buckets.
76+
- Review and tighten IAM policies for roles and users accessing S3.
77+
78+
4. **Post-Incident Review**:
79+
- Audit logs for additional activities by the same user or IP.
80+
- Document findings and apply lessons learned to improve preventive measures.
81+
"""
82+
references = [
83+
"https://www.halcyon.ai/blog/abusing-aws-native-services-ransomware-encrypting-s3-buckets-with-sse-c",
84+
"https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerSideEncryptionCustomerKeys.html",
85+
]
86+
risk_score = 73
87+
rule_id = "c1a9ed70-d349-11ef-841c-f661ea17fbcd"
88+
setup = "AWS S3 data event types need to be enabled in the CloudTrail trail configuration."
89+
severity = "high"
90+
tags = [
91+
"Domain: Cloud",
92+
"Data Source: AWS",
93+
"Data Source: Amazon Web Services",
94+
"Data Source: AWS S3",
95+
"Resources: Investigation Guide",
96+
"Use Case: Threat Detection",
97+
"Tactic: Impact",
98+
]
99+
timestamp_override = "event.ingested"
100+
type = "new_terms"
101+
102+
query = '''
103+
event.dataset: "aws.cloudtrail"
104+
and event.provider: "s3.amazonaws.com"
105+
and event.action: "PutObject"
106+
and event.outcome: "success"
107+
and aws.cloudtrail.flattened.request_parameters.x-amz-server-side-encryption-customer-algorithm: "AES256"
108+
and aws.cloudtrail.flattened.additional_eventdata.SSEApplied: "SSE_C"
109+
'''
110+
111+
112+
[[rule.threat]]
113+
framework = "MITRE ATT&CK"
114+
[[rule.threat.technique]]
115+
id = "T1486"
116+
name = "Data Encrypted for Impact"
117+
reference = "https://attack.mitre.org/techniques/T1486/"
118+
119+
120+
[rule.threat.tactic]
121+
id = "TA0040"
122+
name = "Impact"
123+
reference = "https://attack.mitre.org/tactics/TA0040/"
124+
125+
[rule.investigation_fields]
126+
field_names = [
127+
"@timestamp",
128+
"event.action",
129+
"event.outcome",
130+
"aws.cloudtrail.user_identity.arn",
131+
"aws.cloudtrail.user_identity.type",
132+
"aws.cloudtrail.user_identity.access_key_id",
133+
"aws.cloudtrail.flattened.request_parameters.bucketName",
134+
"aws.cloudtrail.flattened.request_parameters.key",
135+
"aws.cloudtrail.flattened.request_parameters.x-amz-server-side-encryption-customer-algorithm",
136+
"aws.cloudtrail.flattened.additional_eventdata.SSEApplied",
137+
"aws.cloudtrail.response_elements",
138+
"source.ip",
139+
"user_agent.original",
140+
"cloud.region",
141+
"cloud.account.id",
142+
]
143+
144+
[rule.new_terms]
145+
field = "new_terms_fields"
146+
value = ["aws.cloudtrail.user_identity.arn", "aws.cloudtrail.flattened.request_parameters.bucketName"]
147+
[[rule.new_terms.history_window_start]]
148+
field = "history_window_start"
149+
value = "now-14d"
150+
151+

0 commit comments

Comments
 (0)