Skip to content

Commit fcdd1a8

Browse files
terrancedejesusterrancedejesus
authored
Merge branch 'main' into new-rule-aws-attach-or-put-role-policies
2 parents a505199 + f486571 commit fcdd1a8

File tree

4 files changed

+371
-20
lines changed

4 files changed

+371
-20
lines changed

‎rules/integrations/aws/execution_ssm_command_document_created_by_rare_user.toml‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
[metadata]
2+
creation_date = "2024/11/01"
3+
integration = ["aws"]
4+
maturity = "production"
5+
updated_date = "2024/11/01"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
Identifies when an AWS Systems Manager (SSM) command document is created by a user who does not typically perform this action. Adversaries may create SSM command documents to execute commands on managed instances, potentially leading to unauthorized access, command and control, data exfiltration and more.
11+
"""
12+
false_positives = [
13+
"""
14+
Legitimate users may create SSM command documents for legitimate purposes. Ensure that the document is authorized and the user is known before taking action.
15+
""",
16+
]
17+
from = "now-9m"
18+
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
19+
language = "kuery"
20+
license = "Elastic License v2"
21+
name = "AWS SSM Command Document Created by Rare User"
22+
note = """
23+
## Triage and Analysis
24+
25+
### Investigating AWS SSM Command Document Created by Rare User
26+
27+
This rule identifies when an AWS Systems Manager (SSM) command document is created by a user who does not typically perform this action. Creating SSM command documents can be a legitimate action but may also indicate malicious intent if done by an unusual or compromised user. Adversaries may leverage SSM documents to execute commands on managed instances, potentially leading to unauthorized access, command and control, or data exfiltration.
28+
29+
#### Possible Investigation Steps
30+
31+
- **Identify the Actor**: Review the `aws.cloudtrail.user_identity.arn` field to identify who created the SSM document. Verify if this user typically creates such documents and has the appropriate permissions. It may be unexpected for certain types of users, like assumed roles or federated users, to perform this action.
32+
- **Analyze the Document Details**:
33+
- **Document Name**: Check the `aws.cloudtrail.request_parameters.name` field for the document name to understand its intended purpose.
34+
- **Document Content**: If possible, review `aws.cloudtrail.request_parameters.content` for any sensitive or unexpected instructions (e.g., actions for data exfiltration or privilege escalation). If not available via logs, consider reviewing the document in the AWS Management Console.
35+
- **Contextualize the Activity with Related Events**: Look for other CloudTrail events involving the same user ARN or IP address (`source.address`). Examine actions performed in other AWS services, such as IAM, EC2, or S3, to identify if additional suspicious behavior exists. The `SendCommand` API call may indicate attempts to execute the SSM document on managed instances.
36+
- **Check Document Status and Metadata**:
37+
- **Document Status**: Confirm the document creation status in `aws.cloudtrail.response_elements.documentDescription.status`. A status of `Creating` may indicate that the document is in progress.
38+
- **Execution Permissions**: Review if the document specifies `platformTypes` and `documentVersion` in `aws.cloudtrail.response_elements.documentDescription` to understand which environments may be impacted and if multiple versions exist.
39+
40+
### False Positive Analysis
41+
42+
- **Authorized Administrative Actions**: Determine if this document creation aligns with scheduled administrative tasks or actions by authorized personnel.
43+
- **Historical User Actions**: Compare this action against historical activities for the user to determine if they have a history of creating similar documents, which may indicate legitimate usage.
44+
45+
### Response and Remediation
46+
47+
- **Immediate Document Review and Deletion**: If the document creation is deemed unauthorized, delete the document immediately and check for other similar documents created recently.
48+
- **Enhance Monitoring and Alerts**: Configure additional monitoring for SSM document creation events, especially when associated with untrusted or rare users.
49+
- **Policy Update**: Consider restricting SSM document creation permissions to specific, trusted roles or users to prevent unauthorized document creation.
50+
- **Incident Response**: If the document is confirmed as part of malicious activity, treat this as a security incident. Follow incident response protocols, including containment, investigation, and remediation.
51+
52+
### Additional Information
53+
54+
For further guidance on managing and securing AWS Systems Manager in your environment, refer to the [AWS SSM documentation](https://docs.aws.amazon.com/systems-manager/latest/userguide/what-is-systems-manager.html) and AWS security best practices.
55+
"""
56+
references = [
57+
"https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CreateDocument.html",
58+
"https://docs.aws.amazon.com/systems-manager/latest/userguide/documents.html"
59+
]
60+
risk_score = 21
61+
rule_id = "50a2bdea-9876-11ef-89db-f661ea17fbcd"
62+
severity = "low"
63+
tags = [
64+
"Domain: Cloud",
65+
"Data Source: AWS",
66+
"Data Source: Amazon Web Services",
67+
"Data Source: AWS SNS",
68+
"Data Source: AWS Systems Manager",
69+
"Resources: Investigation Guide",
70+
"Use Case: Threat Detection",
71+
"Tactic: Execution"
72+
]
73+
timestamp_override = "event.ingested"
74+
type = "new_terms"
75+
76+
query = '''
77+
event.dataset: "aws.cloudtrail"
78+
and event.provider: "ssm.amazonaws.com"
79+
and event.action: "CreateDocument"
80+
and event.outcome: "success"
81+
and aws.cloudtrail.response_elements: *documentType=Command*
82+
'''
83+
84+
[[rule.threat]]
85+
framework = "MITRE ATT&CK"
86+
87+
[rule.threat.tactic]
88+
id = "TA0002"
89+
name = "Execution"
90+
reference = "https://attack.mitre.org/tactics/TA0002/"
91+
92+
[rule.new_terms]
93+
field = "new_terms_fields"
94+
value = ["aws.cloudtrail.user_identity.arn"]
95+
[[rule.new_terms.history_window_start]]
96+
field = "history_window_start"
97+
value = "now-14d"

‎rules/integrations/aws/exfiltration_sns_email_subscription_by_rare_user.toml‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
[metadata]
2+
creation_date = "2024/11/01"
3+
integration = ["aws"]
4+
maturity = "production"
5+
updated_date = "2024/11/01"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
Identifies when an SNS topic is subscribed to by an email address of a user who does not typically perform this action.
11+
Adversaries may subscribe to an SNS topic to collect sensitive information or exfiltrate data via an external email
12+
address.
13+
"""
14+
false_positives = [
15+
"""
16+
Legitimate users may subscribe to SNS topics for legitimate purposes. Ensure that the subscription is authorized and
17+
the subscription email address is known before taking action.
18+
""",
19+
]
20+
from = "now-9m"
21+
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
22+
language = "kuery"
23+
license = "Elastic License v2"
24+
name = "AWS SNS Email Subscription by Rare User"
25+
note = """## Triage and Analysis
26+
27+
### Investigating AWS SNS Email Subscription by Rare User
28+
29+
This rule identifies when an SNS topic is subscribed to by an email address of a user who does not typically perform this action. While subscribing to SNS topics is a common practice, adversaries may exploit this feature to collect sensitive information or exfiltrate data via an external email address.
30+
31+
#### Possible Investigation Steps
32+
33+
- **Identify the Actor**: Review the `aws.cloudtrail.user_identity.arn` field to identify the user who requested the subscription. Verify if this actor typically performs such actions and has the necessary permissions. It may be unusual for this activity to originate from certain user types, such as an assumed role or federated user.
34+
- **Review the SNS Subscription Event**: Analyze the specifics of the `Subscribe` action in CloudTrail logs:
35+
- **Topic**: Look at the `aws.cloudtrail.request_parameters.topicArn` field to identify the SNS topic involved in the subscription.
36+
- **Protocol and Endpoint**: Review the `aws.cloudtrail.request_parameters.protocol` and `aws.cloudtrail.request_parameters.endpoint` fields to confirm the subscription's protocol and email address. Confirm if this endpoint is associated with a known or trusted entity.
37+
- **Subscription Status**: Check the `aws.cloudtrail.response_elements.subscriptionArn` field for the subscription's current status, noting if it requires confirmation.
38+
- **Verify Authorization**: Evaluate whether the user typically engages in SNS subscription actions and if they are authorized to do so for the specified topic.
39+
- **Contextualize with Related Events**: Review related CloudTrail logs around the event time for other actions by the same user or IP address. Look for activities involving other AWS services, such as S3 or IAM, that may indicate further suspicious behavior.
40+
- **Evaluate the Subscription Endpoint**: Determine whether the email endpoint is legitimate or associated with any known entity. This may require checking internal documentation or reaching out to relevant AWS account administrators.
41+
- **Check for Publish Actions**: Investigate for any subsequent `Publish` actions on the same SNS topic that may indicate exfiltration attempts or data leakage. If Publish actions are detected, further investigate the contents of the messages.
42+
- **Review IAM Policies**: Examine the user or role's IAM policies to ensure that the subscription action is within the scope of their permissions or should be.
43+
44+
### False Positive Analysis
45+
46+
- **Historical User Actions**: Verify if the user has a history of performing similar actions on SNS topics. Consistent, repetitive actions may suggest legitimate usage.
47+
- **Scheduled or Automated Tasks**: Confirm if the subscription action aligns with scheduled tasks or automated notifications authorized by your organization.
48+
49+
### Response and Remediation
50+
51+
- **Immediate Review and Reversal**: If the subscription was unauthorized, take appropriate action to cancel it and adjust SNS permissions as necessary.
52+
- **Strengthen Monitoring and Alerts**: Configure monitoring systems to flag similar actions involving sensitive topics or unapproved endpoints.
53+
- **Policy Review**: Review and update policies related to SNS subscriptions and access, tightening control as needed to prevent unauthorized subscriptions.
54+
- **Incident Response**: If there is evidence of malicious intent, treat the event as a potential data exfiltration incident and follow incident response protocols, including further investigation, containment, and recovery.
55+
56+
### Additional Information
57+
58+
For further guidance on managing and securing SNS topics in AWS environments, refer to the [AWS SNS documentation](https://docs.aws.amazon.com/sns/latest/dg/welcome.html) and AWS best practices for security.
59+
60+
"""
61+
references = ["https://docs.aws.amazon.com/sns/latest/api/API_Subscribe.html"]
62+
risk_score = 21
63+
rule_id = "3df49ff6-985d-11ef-88a1-f661ea17fbcd"
64+
severity = "low"
65+
tags = [
66+
"Domain: Cloud",
67+
"Data Source: AWS",
68+
"Data Source: Amazon Web Services",
69+
"Data Source: AWS SNS",
70+
"Resources: Investigation Guide",
71+
"Use Case: Threat Detection",
72+
"Tactic: Exfiltration",
73+
]
74+
timestamp_override = "event.ingested"
75+
type = "new_terms"
76+
77+
query = '''
78+
event.dataset: "aws.cloudtrail"
79+
and event.provider: "sns.amazonaws.com"
80+
and event.action: "Subscribe"
81+
and aws.cloudtrail.request_parameters: *protocol=email*
82+
'''
83+
84+
85+
[[rule.threat]]
86+
framework = "MITRE ATT&CK"
87+
[[rule.threat.technique]]
88+
id = "T1567"
89+
name = "Exfiltration Over Web Service"
90+
reference = "https://attack.mitre.org/techniques/T1567/"
91+
92+
93+
[rule.threat.tactic]
94+
id = "TA0010"
95+
name = "Exfiltration"
96+
reference = "https://attack.mitre.org/tactics/TA0010/"
97+
98+
[rule.new_terms]
99+
field = "new_terms_fields"
100+
value = ["aws.cloudtrail.user_identity.arn"]
101+
[[rule.new_terms.history_window_start]]
102+
field = "history_window_start"
103+
value = "now-14d"

‎rules/integrations/aws/persistence_iam_create_user_via_assumed_role_on_ec2_instance.toml‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
[metadata]
2+
creation_date = "2024/11/04"
3+
integration = ["aws"]
4+
maturity = "production"
5+
updated_date = "2024/11/04"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
Detects the creation of an AWS Identity and Access Management (IAM) user initiated by an assumed role on an EC2
11+
instance. Assumed roles allow users or services to temporarily adopt different AWS permissions, but the creation of IAM
12+
users through these roles—particularly from within EC2 instances—may indicate a compromised instance. Adversaries might
13+
exploit such permissions to establish persistence by creating new IAM users under unauthorized conditions.
14+
"""
15+
false_positives = [
16+
"""
17+
Assumed roles may be used by legitimate automated systems to create IAM users for specific workflows. Verify if this
18+
event aligns with known automation activities. If the action is routine for specific roles or user agents (e.g.,
19+
`aws-cli`, `boto3`), consider adding those roles or user agents to a monitored exception list for streamlined
20+
review.
21+
""",
22+
]
23+
from = "now-9m"
24+
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
25+
language = "kuery"
26+
license = "Elastic License v2"
27+
name = "AWS IAM Create User via Assumed Role on EC2 Instance"
28+
note = """## Triage and Analysis
29+
30+
### Investigating AWS IAM User Creation via Assumed Role on an EC2 Instance
31+
32+
This rule detects when an AWS Identity and Access Management (IAM) user is created through an assumed role on an EC2 instance. This action may indicate a potentially compromised instance where an adversary could be using the instance’s permissions to create a new IAM user, enabling persistent unauthorized access.
33+
34+
#### Possible Investigation Steps
35+
36+
- **Identify the Assumed Role and Initiating Instance**:
37+
- **Role and Instance**: Examine the `aws.cloudtrail.user_identity.arn` field to determine the specific EC2 instance and role used for this action (e.g., `arn:aws:sts::[account-id]:assumed-role/[role-name]/[instance-id]`). Verify if this behavior aligns with expected usage or represents an anomaly.
38+
- **Session Context**: Check the `session_issuer` fields in `aws.cloudtrail.user_identity.session_context` for details about the role assumed by the instance, along with `mfa_authenticated` to determine if Multi-Factor Authentication (MFA) was used.
39+
40+
- **Analyze the Target IAM User**:
41+
- **New User Details**: Inspect `aws.cloudtrail.flattened.request_parameters.userName` to see the username that was created. Look at `aws.cloudtrail.flattened.response_elements.user.userName` for confirmation of successful user creation, and validate if the user is expected or authorized.
42+
- **Review Creation Time and Context**: Compare the creation time (`@timestamp`) of the user with other activities from the same instance and role to assess if this creation was part of a larger chain of actions.
43+
44+
- **Check User Agent and Tooling**:
45+
- **User Agent Analysis**: Review `user_agent.original` to see if AWS CLI, SDK, or other tooling was used for this request. Identifiers such as `aws-cli`, `boto3`, or similar SDK names can indicate the method used, which may differentiate automation from interactive actions.
46+
- **Source IP and Location**: Use the `source.address` and `source.geo` fields to identify the IP address and geographic location of the event. Verify if this aligns with expected access patterns for your environment.
47+
48+
- **Evaluate for Persistence Indicators**:
49+
- **Role Permissions**: Check the permissions associated with the assumed role (`arn:aws:iam::[account-id]:role/[role-name]`) to determine if creating IAM users is a legitimate activity for this role.
50+
- **Automated Role Patterns**: If the assumed role or instance typically creates IAM users for automation purposes, validate this action against historical records to confirm if the event is consistent with normal patterns.
51+
52+
- **Review Related CloudTrail Events**:
53+
- **Additional IAM Actions**: Investigate for other recent IAM or CloudTrail events tied to this role or instance, especially `CreateAccessKey` or `AttachUserPolicy` actions. These could signal further attempts to empower or utilize the newly created user.
54+
- **Correlate with Other Suspicious Activities**: Determine if other roles or instances recently initiated similar unusual actions, such as privilege escalations or data access.
55+
56+
### False Positive Analysis
57+
58+
- **Expected Automation**: Assumed roles may be used by legitimate automated systems that create users for specific workflows. Confirm if this event aligns with known automation activities.
59+
- **User Agent and Role Exceptions**: If this action is routine for specific roles or user agents (e.g., `aws-cli`, `boto3`), consider adding those roles or user agents to a monitored exception list for streamlined review.
60+
61+
### Response and Remediation
62+
63+
- **Immediate Access Review**: If user creation was unauthorized, restrict the assumed role’s permissions to prevent further user creation.
64+
- **Delete Unauthorized Users**: Confirm and remove any unauthorized IAM users, adjusting IAM policies to reduce similar risks.
65+
- **Enhance Monitoring and Alerts**: Enable enhanced logging or real-time alerts for this role or instance to detect further unauthorized access attempts.
66+
- **Policy Update**: Consider updating IAM policies associated with roles on EC2 instances to limit sensitive actions like IAM user creation.
67+
68+
### Additional Information
69+
70+
For further guidance on managing IAM roles and permissions within AWS environments, refer to the [AWS IAM documentation](https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateUser.html) and AWS best practices for security.
71+
"""
72+
references = [
73+
"https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateUser.html",
74+
"https://www.dionach.com/en-us/breaking-into-the-cloud-red-team-tactics-for-aws-compromise/",
75+
]
76+
risk_score = 47
77+
rule_id = "f7a1c536-9ac0-11ef-9911-f661ea17fbcd"
78+
severity = "medium"
79+
tags = [
80+
"Domain: Cloud",
81+
"Data Source: AWS",
82+
"Data Source: Amazon Web Services",
83+
"Data Source: AWS IAM",
84+
"Use Case: Identity and Access Audit",
85+
"Tactic: Persistence",
86+
]
87+
timestamp_override = "event.ingested"
88+
type = "new_terms"
89+
90+
query = '''
91+
event.dataset: "aws.cloudtrail"
92+
and event.provider: "iam.amazonaws.com"
93+
and event.action: "CreateUser"
94+
and event.outcome: "success"
95+
and aws.cloudtrail.user_identity.type: "AssumedRole"
96+
and aws.cloudtrail.user_identity.arn: *i-*
97+
'''
98+
99+
100+
[[rule.threat]]
101+
framework = "MITRE ATT&CK"
102+
[[rule.threat.technique]]
103+
id = "T1136"
104+
name = "Create Account"
105+
reference = "https://attack.mitre.org/techniques/T1136/"
106+
[[rule.threat.technique.subtechnique]]
107+
id = "T1136.003"
108+
name = "Cloud Account"
109+
reference = "https://attack.mitre.org/techniques/T1136/003/"
110+
111+
112+
113+
[rule.threat.tactic]
114+
id = "TA0003"
115+
name = "Persistence"
116+
reference = "https://attack.mitre.org/tactics/TA0003/"
117+
118+
[rule.new_terms]
119+
field = "new_terms_fields"
120+
value = ["aws.cloudtrail.user_identity.arn"]
121+
[[rule.new_terms.history_window_start]]
122+
field = "history_window_start"
123+
value = "now-14d"
124+
125+

0 commit comments

Comments
 (0)