AWS DynamoDB Scan by Unusual User

This rule identifies when an AWS DynamoDB table is scanned by a user who does not typically perform this action, potentially indicating exfiltration of sensitive information or data from DynamoDB tables. The "AWS DynamoDB Scan by Unusual User" rule, based on the original Elastic detection rule created on 2025/03/13 and last updated on 2026/04/10, monitors for the Scan action in CloudTrail logs. The rule leverages a New Terms approach, flagging when this behavior is observed by a user or role for the first time within a specified history window. This allows for the detection of anomalous activity which might be missed by static threshold-based alerts. The scope is limited to AWS environments where CloudTrail logging is enabled for DynamoDB data events.

Attack Chain

1. Initial Access: An attacker gains unauthorized access to an AWS account, possibly through compromised credentials or a rogue insider.
2. Credential Usage: The attacker leverages the compromised AWS credentials to interact with the AWS environment.
3. Discovery: The attacker uses AWS APIs or the AWS Management Console to discover DynamoDB tables within the environment.
4. Privilege Escalation (Optional): If necessary, the attacker attempts to escalate privileges to gain access to tables they are not normally authorized to access.
5. Data Collection: The attacker uses the Scan operation against a DynamoDB table to collect data. The request parameters within the CloudTrail logs include details of the table being scanned.
6. Staging (Optional): The attacker might stage the collected data in a temporary location within AWS, such as an S3 bucket.
7. Exfiltration: The attacker exfiltrates the collected data outside the AWS environment.
8. Covering Tracks: The attacker attempts to cover their tracks by deleting CloudTrail logs, although this action itself can be detectable.

Impact

Successful exfiltration can lead to significant data breaches, potentially affecting sensitive customer information, financial records, or proprietary business data. The impact includes financial losses due to regulatory fines, legal repercussions, reputational damage, and the cost of incident response. Even a successful attempt to discover DynamoDB tables may reveal information about the cloud environment.

Recommendation

• Enable DynamoDB data events in CloudTrail to capture the Scan action as mentioned in the setup notes.
• Deploy the provided Sigma rule to detect unusual DynamoDB Scan activity and tune it to reduce false positives.
• Investigate any alerts generated by the Sigma rule, focusing on the source IP, user identity, and the request parameters of the Scan action, as described in the rule's notes.
• Review and harden IAM policies associated with users and roles to restrict access to DynamoDB tables based on the principle of least privilege.
• Monitor CloudTrail logs for unusual API calls and access patterns, including the use of aws.cloudtrail.user_identity.access_key_id for unusual activity.
• Leverage the rule.investigation_fields to build dashboards and hunting queries in your SIEM to support the triage process.