You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
[Rule Tuning] AWS CLI with Kali Linux Fingerprint Identified
This rule is performing well in telemetry as expected. I changed this to EQL to avoid the multiple wildcards needed with KQL.
- changed rule type to EQL
- reduced execution window
- updated description, false positive and investigation guide
Script for testing this rule:
Manually perform any action against our AWS account using Kali Linux distribution
#### Screenshot showing working EQL query, still captures the BitPanda behavior this rule was initially designed around.
Copy file name to clipboardExpand all lines: rules/integrations/aws/initial_access_kali_user_agent_detected_with_aws_cli.toml
+80-28Lines changed: 80 additions & 28 deletions
Original file line number
Diff line number
Diff line change
@@ -2,48 +2,97 @@
2
2
creation_date = "2025/04/11"
3
3
integration = ["aws"]
4
4
maturity = "production"
5
-
updated_date = "2025/04/16"
5
+
updated_date = "2025/12/15"
6
6
7
7
[rule]
8
8
author = ["Elastic"]
9
9
description = """
10
-
Identifies the usage of the AWS CLI with a user agent string containing `distrib#kali`, which suggests the request
11
-
was made from a Kali Linux distribution. This may indicate offensive security tooling or unauthorized use of the AWS CLI
12
-
from a potentially adversarial environment.
10
+
Identifies usage of the AWS CLI from a client reporting a user agent string indicating the request was made from a Kali
11
+
Linux distribution. Kali Linux is commonly used for offensive security testing and adversary tradecraft. While not
12
+
inherently malicious, AWS CLI activity originating from Kali is uncommon in most production environments and may
13
+
indicate compromised credentials, unauthorized access, or post-exploitation activity using valid cloud accounts.
13
14
"""
14
15
false_positives = [
15
16
"""
16
-
While rare, legitimate users or red teamers may use Kali Linux for security assessments. Confirm the identity of the
17
-
user, their purpose, and whether the activity was authorized.
17
+
Authorized security assessments, red team exercises, or defensive research activities may involve the use of Kali
18
+
Linux. Validate whether the IAM principal, source network, and activity scope align with approved testing or
19
+
security operations. Any Kali-originated activity outside documented security workflows should be investigated.
18
20
""",
19
21
]
20
-
from = "now-9m"
22
+
from = "now-6m"
21
23
index = ["logs-aws.cloudtrail-*"]
22
-
language = "kuery"
24
+
language = "eql"
23
25
license = "Elastic License v2"
24
26
name = "AWS CLI with Kali Linux Fingerprint Identified"
25
27
note = """## Triage and Analysis
26
28
27
-
### Investigating AWS CLI with Kali Linux Fingerprint Identified
28
-
29
-
The `user_agent.original` field in AWS CloudTrail logs reveals the operating system and toolchain used to make API calls. The substring `distrib#kali` strongly implies the use of Kali Linux, a common OS used by offensive security professionals and adversaries.
30
-
31
-
#### Possible Investigation Steps
32
-
33
-
- Identify the User: Check `user.name`, `user.arn`, and `aws.cloudtrail.user_identity.*` to determine which IAM identity was used.
34
-
- Review Access Pattern: Correlate API calls from this user agent with sensitive actions such as `PutObject`, `CreateUser`, `AttachUserPolicy`, etc.
35
-
- Investigate Source IP: Examine whether the request originated from an expected network or a suspicious VPN or cloud provider address.
36
-
- Check for Initial Access: Look for session tokens being issued (e.g., `GetSessionToken`) or reused (`AssumeRole`) prior to this event.
29
+
> **Disclaimer**:
30
+
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
37
31
38
-
### False Positive Analysis
39
-
40
-
- Rare but possible in security assessments or internal red teaming. Validate the action context (user, IP, time of day, etc).
41
-
42
-
### Response and Remediation
32
+
### Investigating AWS CLI with Kali Linux Fingerprint Identified
43
33
44
-
- Revoke Credentials: If unauthorized, revoke keys or sessions immediately.
45
-
- Harden IAM Policies: Restrict sensitive IAM privileges, especially if used by CI/CD or automation roles.
46
-
- Alert on Repeat Usage: Add recurring monitoring for suspicious user agents including `kali`, `curl`, or known toolkits.
34
+
AWS CloudTrail captures the user agent string for API requests, which can provide insight into the operating system and tooling used. The presence of `distrib#kali` strongly suggests the AWS CLI was executed from a Kali Linux environment. Kali is widely used for penetration testing, red teaming, and adversarial operations, making its appearance in AWS API telemetry noteworthy, especially when associated with sensitive actions or unexpected identities.
35
+
36
+
This detection focuses on successful AWS CLI activity and should be evaluated in the context of who performed the action, what was accessed or modified, and where the request originated.
37
+
38
+
### Possible investigation steps
39
+
40
+
- **Identify the User**
41
+
- Check `user.name`, `user.arn`, and `aws.cloudtrail.user_identity.*` to determine which IAM identity was used.
42
+
- **Review Access Pattern**
43
+
- Correlate API calls from this user agent with sensitive actions such as `PutObject`, `CreateUser`, `AttachUserPolicy`, etc.
44
+
- **Investigate Source IP**
45
+
- Examine whether the request originated from an expected network or a suspicious VPN or cloud provider address.
46
+
- **Check for Initial Access**
47
+
- Look for session tokens being issued (e.g., `GetSessionToken`) or reused (`AssumeRole`) prior to this event.
48
+
49
+
50
+
**Identify the actor**
51
+
- Review `user.name` and `aws.cloudtrail.user_identity.arn` to determine which IAM
52
+
principal was used.
53
+
- Check whether this principal normally interacts with AWS via CLI tooling and whether Kali Linux usage is expected.
54
+
55
+
**Review access patterns and actions**
56
+
- Examine the API calls associated with this user agent for high-risk activity such as IAM changes, data access, snapshot
57
+
sharing, logging modification, or persistence-related actions.
58
+
- Look for sequences indicating initial access or expansion, such as `GetSessionToken`, `AssumeRole`, or privilege
59
+
escalation attempts.
60
+
- Determine whether the activity scope aligns with the role’s intended permissions and business function.
61
+
62
+
**Inspect source network and tooling context**
63
+
- Review `source.ip`, `source.geo` fields, and ASN to determine whether the request originated from an expected corporate
64
+
network, VPN, or known security testing infrastructure.
65
+
- Analyze `user_agent.original` to confirm CLI usage and identify automation versus interactive usage.
66
+
- Sudden shifts from console-based access to CLI usage from Kali may indicate credential compromise.
67
+
68
+
**Correlate with surrounding activity**
69
+
- Search for additional CloudTrail events tied to the same access key or session before and after this detection.
70
+
- Look for evidence of follow-on actions such as resource creation, configuration changes, or attempts to disable logging and monitoring services.
71
+
- Assess whether the activity represents a single isolated request or part of a broader behavioral chain.
72
+
73
+
### False positive analysis
74
+
75
+
- Internal red team or security testing activity may legitimately generate Kali-based AWS CLI traffic. Confirm scope,
76
+
timing, and authorization with security leadership.
77
+
- Compare against historical behavior for the same IAM principal to determine whether Kali usage is a deviation from
78
+
baseline access patterns.
79
+
80
+
### Response and remediation
81
+
82
+
- If the activity is unauthorized, immediately revoke or rotate the affected access keys or invalidate the active
83
+
session.
84
+
- Review IAM permissions associated with the identity and reduce scope where possible to enforce least privilege.
85
+
- Investigate for additional indicators of compromise, including unusual role assumptions, new credential creation, or
86
+
data access from the same identity.
87
+
- Notify security operations and incident response teams if the activity aligns with known adversary behaviors or appears
88
+
part of a larger intrusion.
89
+
- Consider adding guardrails or conditional access controls (such as source IP restrictions or MFA enforcement) for
90
+
sensitive IAM principals.
91
+
92
+
### Additional information
93
+
- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)**
0 commit comments