You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: rules/integrations/aws/defense_evasion_sts_get_federation_token.toml
+55-22Lines changed: 55 additions & 22 deletions
Original file line number
Diff line number
Diff line change
@@ -2,60 +2,62 @@
2
2
creation_date = "2024/08/19"
3
3
integration = ["aws"]
4
4
maturity = "production"
5
-
updated_date = "2025/01/15"
5
+
updated_date = "2025/08/25"
6
6
7
7
[rule]
8
8
author = ["Elastic"]
9
9
description = """
10
-
Identifies the first occurrence of an AWS Security Token Service (STS) `GetFederationToken` request made by a user
11
-
within the last 10 days. The `GetFederationToken` API call allows users to request temporary security credentials to
12
-
access AWS resources. Adversaries may use this API to obtain temporary credentials to access resources they would not
13
-
normally have access to.
10
+
Identifies the first occurrence of an AWS Security Token Service (STS) GetFederationToken request made by a user. The GetFederationToken API call allows users to request temporary security credentials to
11
+
access AWS resources. The maximum expiration period for these tokens is 36 hours and they can be used to create a console signin token even for identities that don't already have one. Adversaries may use this API to obtain temporary credentials for persistence and to bypass IAM API call limitations by gaining console access.
14
12
"""
15
-
from = "now-9m"
13
+
from = "now-6m"
16
14
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
17
15
language = "kuery"
18
16
license = "Elastic License v2"
19
-
name = "First Occurrence of STS GetFederationToken Request by User"
17
+
name = "AWS First Occurrence of STS GetFederationToken Request by User"
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
47
49
48
-
### Investigating First Occurrence of STS GetFederationToken Request by User
50
+
### Investigating AWS First Occurrence of STS GetFederationToken Request by User
49
51
50
-
AWS Security Token Service (STS) enables users to request temporary credentials for accessing AWS resources. While beneficial for legitimate use, adversaries may exploit this to gain unauthorized access. The detection rule identifies unusual activity by flagging the first instance of a `GetFederationToken` request by a user within a 10-day window, helping to uncover potential misuse aimed at evading defenses.
52
+
AWS Security Token Service (STS) enables users to request temporary credentials for accessing AWS resources. While beneficial for legitimate use, adversaries may exploit this to gain unauthorized access. These credentials will remain active for the duration specified (maximum 36 hours), even if the initial compromised identity is deleted. They can also be used to request a console signin token which allows the adversary to make sensitive IAM API calls which would otherwise be denied with the federation token alone. The detection rule identifies unusual activity by flagging the first instance of a `GetFederationToken` request by a user helping to uncover potential misuse aimed at evading defenses and gaining persistence.
51
53
52
54
### Possible investigation steps
53
55
54
-
- Review the specific user account associated with the GetFederationToken request to determine if the activity aligns with their typical behavior and role within the organization.
55
-
- Examine the AWS CloudTrail logs for additional context around the time of the GetFederationToken request, looking for any other unusual or suspicious activities by the same user or related accounts.
56
-
- Check the source IP address and geolocation of the GetFederationToken request to identify if it originates from an expected or unexpected location.
57
-
- Investigate the resources accessed using the temporary credentials obtained from the GetFederationToken request to assess if there was any unauthorized or suspicious access.
58
-
- Consult with the user or their manager to verify if the GetFederationToken request was legitimate and necessary for their work tasks.
56
+
- Review the specific user account associated with the `GetFederationToken` request to determine if the activity aligns with their typical behavior and role within the organization.
57
+
- Examine the AWS CloudTrail logs for additional context around the time of the `GetFederationToken` request, looking for any other unusual or suspicious activities by the same user or related accounts.
58
+
- Check the `source.ip` and `source.geo` fields of the request to identify if it originates from an expected or unexpected location.
59
+
- View the `aws.cloudtrail.response_elements` to find the created `federatedUser.arn`. Investigate the resources accessed by this Federated User to assess if there was any suspicious activity.
60
+
- Consult with the requesting user `aws.cloudtrail.user_identity.arn` to verify if the `GetFederationToken` request was legitimate and necessary for their work tasks.
59
61
60
62
### False positive analysis
61
63
@@ -66,14 +68,29 @@ AWS Security Token Service (STS) enables users to request temporary credentials
66
68
67
69
### Response and remediation
68
70
69
-
- Immediately revoke the temporary credentials associated with the `GetFederationToken` request to prevent unauthorized access to AWS resources.
70
-
- Review CloudTrail logs to identify any suspicious activities performed using the temporary credentials and assess the potential impact on AWS resources.
71
-
- Isolate the affected user account by disabling it temporarily to prevent further unauthorized actions until a thorough investigation is completed.
71
+
- If compromise is verified, attach a policy that denies all actions, effectively preventing any further activity, even from temporary credentials. You can use the AWS-managed policy [AWSDenyAll](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSDenyAll.html). This ensures that any temporary credentials generated by the compromised user are also blocked, stopping the attacker’s activities.
72
72
- Notify the security team and relevant stakeholders about the incident for awareness and further investigation.
73
73
- Conduct a root cause analysis to determine how the `GetFederationToken` request was initiated and identify any potential security gaps or misconfigurations.
74
74
- Implement additional monitoring and alerting for `GetFederationToken` requests to detect and respond to similar activities promptly in the future.
75
75
- Review and update IAM policies and permissions to ensure that only authorized users have the ability to request temporary credentials, reducing the risk of misuse."""
Copy file name to clipboardExpand all lines: rules/integrations/aws/execution_new_terms_cloudformation_createstack.toml
+39-25Lines changed: 39 additions & 25 deletions
Original file line number
Diff line number
Diff line change
@@ -1,21 +1,17 @@
1
1
[metadata]
2
-
creation_date = "2020/07/25"
2
+
creation_date = "2024/07/25"
3
3
integration = ["aws"]
4
4
maturity = "production"
5
-
updated_date = "2025/01/15"
5
+
updated_date = "2025/08/27"
6
6
7
7
[rule]
8
8
author = ["Elastic"]
9
9
description = """
10
-
This rule detects the first time a principal calls AWS Cloudwatch `CreateStack` or `CreateStackSet` API. Cloudformation
11
-
is used to create a single collection of cloud resources called a stack, via a defined template file. An attacker with
12
-
the appropriate privileges could leverage Cloudformation to create specific resources needed to further exploit the
13
-
environment. This is a new terms rule that looks for the first instance of this behavior in the last 10 days for a role
14
-
or IAM user within a particular account.
10
+
This rule detects the first time a principal calls AWS CloudFormation CreateStack, CreateStackSet or CreateStackInstances API. CloudFormation is used to create a collection of cloud resources called a stack, via a defined template file. An attacker with the appropriate privileges could leverage CloudFormation to create specific resources needed to further exploit the environment. This is a new terms rule that looks for the first instance of this behavior for a role or IAM user within a particular account.
15
11
"""
16
12
false_positives = [
17
13
"""
18
-
Verify whether the user identity should be using the `CreateStack` or `CreateStackSet` APIs. If known behavior is
14
+
Verify whether the user identity should be using the triggered API. If known behavior is
19
15
causing false positives, it can be exempted from the rule. The "history_window_start" value can be modified to
20
16
reflect the expected frequency of known activity within a particular environment.
21
17
""",
@@ -24,12 +20,10 @@ from = "now-6m"
24
20
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
25
21
language = "kuery"
26
22
license = "Elastic License v2"
27
-
name = "First Time AWS Cloudformation Stack Creation by User"
23
+
name = "First Time AWS CloudFormation Stack Creation"
event.dataset:aws.cloudtrail and event.provider:cloudformation.amazonaws.com and
51
-
event.action: (CreateStack or CreateStackSet) and event.outcome:success
45
+
event.action: (CreateStack or CreateStackInstances)
46
+
and event.outcome:success
52
47
'''
53
48
note = """## Triage and analysis
54
49
55
50
> **Disclaimer**:
56
51
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
57
52
58
-
### Investigating First Time AWS Cloudformation Stack Creation by User
53
+
### Investigating First Time AWS CloudFormation Stack Creation
59
54
60
-
AWS CloudFormation automates the setup of cloud resources using templates, streamlining infrastructure management. Adversaries with access can exploit this to deploy malicious resources, escalating their control. The detection rule identifies unusual activity by flagging the initial use of stack creation APIs by a user, helping to spot potential unauthorized actions early.
55
+
AWS CloudFormation automates the setup of cloud resources using templates, streamlining infrastructure management. Adversaries with access can exploit this to deploy malicious resources, escalating their control. The detection rule identifies unusual activity by flagging the initial use of stack creation APIs by a user or role, helping to spot potential unauthorized actions early.
61
56
62
57
### Possible investigation steps
63
58
64
-
- Review the CloudTrail logs for the specific event.dataset:aws.cloudtrail and event.provider:cloudformation.amazonaws.com to identify the user or role that initiated the CreateStack or CreateStackSet action.
59
+
- Review `aws.cloudtrail.user_identity.arn` to identify the user or role that initiated the `CreateStack` or `CreateStackInstances` action.
65
60
- Verify the IAM permissions of the user or role involved in the event to ensure they have the appropriate level of access and determine if the action aligns with their typical responsibilities.
66
-
- Examine the stack template used in the CreateStack or CreateStackSet action to identify any unusual or unauthorized resources being provisioned.
67
-
- Check the event.outcome:success field to confirm the stack creation was successful and investigate any related resources that were deployed as part of the stack.
61
+
- Examine the stack template used to identify any unusual or unauthorized resources being provisioned.
62
+
- Investigate any related resources that were deployed as part of the stack.
68
63
- Correlate the timing of the stack creation with other logs or alerts to identify any suspicious activity or patterns that might indicate malicious intent.
69
64
- Investigate the account's recent activity history to determine if there have been any other first-time or unusual actions by the same user or role.
70
65
@@ -78,18 +73,37 @@ AWS CloudFormation automates the setup of cloud resources using templates, strea
78
73
79
74
### Response and remediation
80
75
81
-
- Immediately isolate the IAM user or role that initiated the stack creation to prevent further unauthorized actions. This can be done by revoking permissions or disabling the account temporarily.
82
-
- Review the created stack and stack set for any unauthorized or suspicious resources. Identify and terminate any resources that are not part of the expected infrastructure.
76
+
- Immediately isolate the IAM user or role that initiated the stack creation to prevent further unauthorized actions. This can be done by revoking permissions with a [DenyAll](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSDenyAll.html) permissions policy or disabling the account temporarily.
77
+
- Review the created stack for any unauthorized or suspicious resources. Identify and terminate any resources that are not part of the expected infrastructure.
83
78
- Conduct a thorough audit of recent IAM activity to identify any other unusual or unauthorized actions that may indicate further compromise.
84
79
- If malicious activity is confirmed, escalate the incident to the security operations team for a full investigation and potential involvement of incident response teams.
85
80
- Implement additional monitoring and alerting for the affected account to detect any further unauthorized attempts to use CloudFormation or other critical AWS services.
86
-
- Review and tighten IAM policies and permissions to ensure that only necessary privileges are granted, reducing the risk of exploitation by adversaries.
87
-
- Consider enabling AWS CloudTrail logging and AWS Config rules to maintain a detailed record of all API activity and configuration changes for ongoing monitoring and compliance."""
88
-
81
+
- Review and tighten IAM policies and permissions to ensure that only necessary privileges are granted, reducing the risk of exploitation by adversaries."""
0 commit comments