Skip to content

Commit f15c3fa

Browse files
terrancedejesusgithub-actions[bot]
terrancedejesus
authored and
github-actions[bot]
committed
[Rule Tuning] Tuning AWS STS Temporary Credentials via AssumeRole (#4228)
* tuning 'AWS STS Temporary Credentials via AssumeRole' * linted; adjusted OR in quer * added investigation guide * Update rules/integrations/aws/privilege_escalation_sts_temp_creds_via_assume_role.toml * Update rules/integrations/aws/privilege_escalation_sts_temp_creds_via_assume_role.toml Co-authored-by: Ruben Groenewoud <[email protected]> * added new rule 'AWS STS Role Assumption by User' * adjusted UUID * Update rules/integrations/aws/privilege_escalation_role_assumption_by_service.toml --------- Co-authored-by: Ruben Groenewoud <[email protected]> Co-authored-by: Isai <[email protected]> (cherry picked from commit ef6344f)
1 parent 394ff8f commit f15c3fa

File tree

3 files changed

+279
-90
lines changed

3 files changed

+279
-90
lines changed

‎rules/integrations/aws/privilege_escalation_role_assumption_by_service.toml‎

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
[metadata]
2+
creation_date = "2021/05/17"
3+
integration = ["aws"]
4+
maturity = "production"
5+
updated_date = "2024/11/05"
6+
7+
[rule]
8+
author = ["Elastic", "Austin Songer"]
9+
description = """
10+
Identifies when a service has assumed a role in AWS Security Token Service (STS). Services can assume a role to obtain
11+
temporary credentials and access AWS resources. Adversaries can use this technique for credential access and privilege
12+
escalation. This is a [New
13+
Terms](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-new-terms-rule) rule that identifies
14+
when a service assumes a role in AWS Security Token Service (STS) to obtain temporary credentials and access AWS
15+
resources. While often legitimate, adversaries may use this technique for unauthorized access, privilege escalation, or
16+
lateral movement within an AWS environment.
17+
"""
18+
false_positives = [
19+
"AWS administrators or automated processes might regularly assume roles for legitimate administrative purposes.",
20+
"AWS services might assume roles to access AWS resources as part of their standard operations.",
21+
"Automated workflows might assume roles to perform periodic tasks such as data backups, updates, or deployments.",
22+
]
23+
from = "now-9m"
24+
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
25+
language = "kuery"
26+
license = "Elastic License v2"
27+
name = "AWS STS Role Assumption by Service"
28+
note = """## Triage and Analysis
29+
30+
### Investigating AWS STS Role Assumption by Service
31+
32+
This rule identifies instances where AWS STS (Security Token Service) is used to assume a role, granting temporary credentials for AWS resource access. While this action is often legitimate, it can be exploited by adversaries to obtain unauthorized access, escalate privileges, or move laterally within an AWS environment.
33+
34+
#### Possible Investigation Steps
35+
36+
- **Identify the Actor and Assumed Role**:
37+
- **User Identity**: Review the `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.type` fields to determine who initiated the `AssumeRole` action.
38+
- **Role Assumed**: Check the `aws.cloudtrail.flattened.request_parameters.roleArn` field to confirm the assumed role and ensure it aligns with expected responsibilities.
39+
- **Session Name**: Observe the `aws.cloudtrail.flattened.request_parameters.roleSessionName` for context on the session's intended purpose, if available.
40+
41+
- **Analyze the Role Session and Duration**:
42+
- **Session Context**: Look at the `aws.cloudtrail.user_identity.session_context.creation_date` to understand when the session began and check if multi-factor authentication (MFA) was used, indicated by the `aws.cloudtrail.user_identity.session_context.mfa_authenticated` field.
43+
- **Credential Validity**: Examine the `aws.cloudtrail.flattened.request_parameters.durationSeconds` for the credential's validity period.
44+
- **Expiration Time**: Verify `aws.cloudtrail.flattened.response_elements.credentials.expiration` to determine when the credentials expire or expired.
45+
46+
- **Inspect the User Agent for Tooling Identification**:
47+
- **User Agent Details**: Review the `user_agent.original` field to identify the tool or SDK used for the role assumption. Indicators include:
48+
- **AWS SDKs (e.g., Boto3)**: Often used in automated workflows or scripts.
49+
- **AWS CLI**: Suggests command-line access, potentially indicating direct user interaction.
50+
- **Custom Tooling**: Unusual user agents may signify custom or suspicious tools.
51+
- **Source IP and Location**: Evaluate the `source.address` and `source.geo` fields to confirm if the access source aligns with typical access locations for your environment.
52+
53+
- **Contextualize with Related Events**:
54+
- **Review Event Patterns**: Check surrounding CloudTrail events to see if other actions coincide with this `AssumeRole` activity, such as attempts to access sensitive resources.
55+
- **Identify High-Volume Exceptions**: Due to the potential volume of `AssumeRole` events, determine common, legitimate `roleArn` values or `user_agent` patterns, and consider adding these as exceptions to reduce noise.
56+
57+
- **Evaluate the Privilege Level of the Assumed Role**:
58+
- **Permissions**: Inspect permissions associated with the assumed role to understand its access level.
59+
- **Authorized Usage**: Confirm whether the role is typically used for administrative purposes and if the assuming entity frequently accesses it as part of regular responsibilities.
60+
61+
### False Positive Analysis
62+
63+
- **Automated Workflows and Applications**: Many applications or scheduled tasks may assume roles for standard operations. Check user agents and ARNs for consistency with known workflows.
64+
- **Routine IAM Policy Actions**: Historical data may reveal if the same user or application assumes this specific role regularly as part of authorized operations.
65+
66+
### Response and Remediation
67+
68+
- **Revoke Unauthorized Sessions**: If unauthorized, consider revoking the session by adjusting IAM policies or permissions associated with the assumed role.
69+
- **Enhance Monitoring and Alerts**: Set up enhanced monitoring for high-risk roles, especially those with elevated privileges.
70+
- **Manage Exceptions**: Regularly review and manage high-frequency roles and user agent patterns, adding trusted ARNs and user agents to exception lists to minimize alert fatigue.
71+
- **Incident Response**: If malicious behavior is identified, follow incident response protocols, including containment, investigation, and remediation.
72+
73+
### Additional Information
74+
75+
For more information on managing and securing AWS STS, refer to the [AWS STS documentation](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html) and AWS security best practices.
76+
"""
77+
references = ["https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html"]
78+
risk_score = 21
79+
rule_id = "93075852-b0f5-4b8b-89c3-a226efae5726"
80+
severity = "low"
81+
tags = [
82+
"Domain: Cloud",
83+
"Data Source: AWS",
84+
"Data Source: Amazon Web Services",
85+
"Data Source: AWS STS",
86+
"Resources: Investigation Guide",
87+
"Use Case: Identity and Access Audit",
88+
"Tactic: Privilege Escalation",
89+
]
90+
timestamp_override = "event.ingested"
91+
type = "new_terms"
92+
93+
query = '''
94+
event.dataset: "aws.cloudtrail"
95+
and event.provider: "sts.amazonaws.com"
96+
and event.action: "AssumeRole"
97+
and event.outcome: "success"
98+
and aws.cloudtrail.user_identity.type: "AWSService"
99+
and not aws.cloudtrail.user_identity.invoked_by: (
100+
"config.amazonaws.com" or
101+
"securityhub.amazonaws.com" or
102+
"sso.amazonaws.com"
103+
)
104+
'''
105+
106+
107+
[[rule.threat]]
108+
framework = "MITRE ATT&CK"
109+
[[rule.threat.technique]]
110+
id = "T1548"
111+
name = "Abuse Elevation Control Mechanism"
112+
reference = "https://attack.mitre.org/techniques/T1548/"
113+
114+
115+
[rule.threat.tactic]
116+
id = "TA0004"
117+
name = "Privilege Escalation"
118+
reference = "https://attack.mitre.org/tactics/TA0004/"
119+
[[rule.threat]]
120+
framework = "MITRE ATT&CK"
121+
[[rule.threat.technique]]
122+
id = "T1550"
123+
name = "Use Alternate Authentication Material"
124+
reference = "https://attack.mitre.org/techniques/T1550/"
125+
[[rule.threat.technique.subtechnique]]
126+
id = "T1550.001"
127+
name = "Application Access Token"
128+
reference = "https://attack.mitre.org/techniques/T1550/001/"
129+
130+
131+
132+
[rule.threat.tactic]
133+
id = "TA0008"
134+
name = "Lateral Movement"
135+
reference = "https://attack.mitre.org/tactics/TA0008/"
136+
137+
[rule.new_terms]
138+
field = "new_terms_fields"
139+
value = ["aws.cloudtrail.resources.arn", "aws.cloudtrail.user_identity.invoked_by"]
140+
[[rule.new_terms.history_window_start]]
141+
field = "history_window_start"
142+
value = "now-14d"
143+
144+

‎rules/integrations/aws/privilege_escalation_role_assumption_by_user.toml‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
[metadata]
2+
creation_date = "2024/11/05"
3+
integration = ["aws"]
4+
maturity = "production"
5+
updated_date = "2024/11/05"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
Identifies when a user or role has assumed a role in AWS Security Token Service (STS). Users can assume a role to obtain
11+
temporary credentials and access AWS resources. Adversaries can use this technique for credential access and privilege
12+
escalation. This is a [New
13+
Terms](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-new-terms-rule) rule that identifies
14+
when a service assumes a role in AWS Security Token Service (STS) to obtain temporary credentials and access AWS
15+
resources. While often legitimate, adversaries may use this technique for unauthorized access, privilege escalation, or
16+
lateral movement within an AWS environment.
17+
"""
18+
false_positives = [
19+
"AWS administrators or automated processes might regularly assume roles for legitimate administrative purposes.",
20+
"Applications integrated with AWS might assume roles to access AWS resources.",
21+
"Automated workflows might assume roles to perform periodic tasks such as data backups, updates, or deployments.",
22+
]
23+
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
24+
language = "kuery"
25+
license = "Elastic License v2"
26+
name = "AWS STS Role Assumption by User"
27+
note = """## Triage and Analysis
28+
29+
### Investigating AWS STS Role Assumption by User
30+
31+
This rule detects when a user assumes a role in AWS Security Token Service (STS), receiving temporary credentials to access AWS resources. While often used for legitimate purposes, this action can be leveraged by adversaries to obtain unauthorized access, escalate privileges, or move laterally within an AWS environment.
32+
33+
#### Possible Investigation Steps
34+
35+
- **Identify the User and Assumed Role**:
36+
- **User Identity**: Check `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.type` for details about the initiator of the `AssumeRole` action.
37+
- **Role Assumed**: Review `aws.cloudtrail.flattened.request_parameters.roleArn` to confirm the role assumed and ensure it aligns with the user’s standard permissions.
38+
- **Session Name**: Note `aws.cloudtrail.flattened.request_parameters.roleSessionName` for context on the purpose of the session.
39+
40+
- **Evaluate Session Context and Credential Duration**:
41+
- **Session Details**: Look into `aws.cloudtrail.user_identity.session_context.creation_date` for the start of the session and `aws.cloudtrail.user_identity.session_context.mfa_authenticated` to check for MFA usage.
42+
- **Credential Validity**: Examine `aws.cloudtrail.flattened.request_parameters.durationSeconds` for how long the credentials are valid.
43+
- **Expiration Time**: Use `aws.cloudtrail.flattened.response_elements.credentials.expiration` to confirm the credential expiration.
44+
45+
- **Inspect User Agent and Source Information**:
46+
- **User Agent**: Analyze the `user_agent.original` field to identify if specific tooling or SDKs like AWS CLI, Boto3, or custom agents were used.
47+
- **Source IP and Geolocation**: Examine `source.address` and `source.geo` fields to determine the origin of the request, confirming if it aligns with expected locations.
48+
49+
- **Correlate with Related Events**:
50+
- **Identify Patterns**: Review related CloudTrail events for unusual access patterns, such as resource access or sensitive actions following this `AssumeRole` action.
51+
- **Filter High-Volume Roles**: If this role or user has a high volume of access, evaluate `roleArn` or `user_agent` values for common patterns and add trusted entities as exceptions.
52+
53+
- **Review the Privileges of the Assumed Role**:
54+
- **Permissions**: Examine permissions associated with the `roleArn` to assess its access scope.
55+
- **Authorized Usage**: Confirm if the role is used frequently for administrative purposes and if this aligns with the user’s regular responsibilities.
56+
57+
### False Positive Analysis
58+
59+
- **Automated Processes and Applications**: Applications or scheduled tasks may assume roles regularly for operational purposes. Validate the consistency of the `user_agent` or `roleArn` with known automated workflows.
60+
- **Standard IAM Policy Usage**: Confirm if the user or application routinely assumes this specific role for normal operations by reviewing historical activity.
61+
62+
### Response and Remediation
63+
64+
- **Terminate Unauthorized Sessions**: If the role assumption is deemed unauthorized, revoke the session by modifying IAM policies or the permissions associated with the assumed role.
65+
- **Strengthen Monitoring and Alerts**: Implement additional monitoring for specific high-risk roles, especially those with elevated permissions.
66+
- **Regularly Manage Exceptions**: Regularly review high-volume roles and user agent patterns to refine alerts, minimizing noise by adding trusted patterns as exceptions.
67+
- **Incident Response**: If confirmed as malicious, follow incident response protocols for containment, investigation, and remediation.
68+
69+
### Additional Information
70+
71+
For more details on managing and securing AWS STS in your environment, refer to the [AWS STS documentation](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html).
72+
"""
73+
references = ["https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html"]
74+
risk_score = 21
75+
rule_id = "288a198e-9b9b-11ef-a0a8-f661ea17fbcd"
76+
severity = "low"
77+
tags = [
78+
"Domain: Cloud",
79+
"Data Source: AWS",
80+
"Data Source: Amazon Web Services",
81+
"Data Source: AWS STS",
82+
"Resources: Investigation Guide",
83+
"Use Case: Identity and Access Audit",
84+
"Tactic: Privilege Escalation",
85+
]
86+
timestamp_override = "event.ingested"
87+
type = "new_terms"
88+
89+
query = '''
90+
event.dataset: "aws.cloudtrail"
91+
and event.provider: "sts.amazonaws.com"
92+
and event.action: "AssumeRole"
93+
and event.outcome: "success"
94+
and aws.cloudtrail.user_identity.type: ("AssumedRole" or "IAMUser")
95+
'''
96+
97+
98+
[[rule.threat]]
99+
framework = "MITRE ATT&CK"
100+
[[rule.threat.technique]]
101+
id = "T1548"
102+
name = "Abuse Elevation Control Mechanism"
103+
reference = "https://attack.mitre.org/techniques/T1548/"
104+
105+
106+
[rule.threat.tactic]
107+
id = "TA0004"
108+
name = "Privilege Escalation"
109+
reference = "https://attack.mitre.org/tactics/TA0004/"
110+
[[rule.threat]]
111+
framework = "MITRE ATT&CK"
112+
[[rule.threat.technique]]
113+
id = "T1550"
114+
name = "Use Alternate Authentication Material"
115+
reference = "https://attack.mitre.org/techniques/T1550/"
116+
[[rule.threat.technique.subtechnique]]
117+
id = "T1550.001"
118+
name = "Application Access Token"
119+
reference = "https://attack.mitre.org/techniques/T1550/001/"
120+
121+
122+
123+
[rule.threat.tactic]
124+
id = "TA0008"
125+
name = "Lateral Movement"
126+
reference = "https://attack.mitre.org/tactics/TA0008/"
127+
128+
[rule.new_terms]
129+
field = "new_terms_fields"
130+
value = ["user.name", "aws.cloudtrail.flattened.request_parameters.roleArn"]
131+
[[rule.new_terms.history_window_start]]
132+
field = "history_window_start"
133+
value = "now-10d"
134+
135+

‎rules/integrations/aws/privilege_escalation_sts_temp_creds_via_assume_role.toml‎

Lines changed: 0 additions & 90 deletions
This file was deleted.

0 commit comments

Comments
 (0)