AWS IAM Account Concurrent Sessions from Multiple IPs

This analytic identifies AWS IAM accounts that have concurrent sessions originating from more than one unique IP address within a 5-minute window. The detection leverages AWS CloudTrail logs, specifically the DescribeEventAggregates event. The goal is to detect potential session hijacking attacks, where an attacker uses stolen session cookies or credentials to access AWS resources from a different location than the legitimate user. This can lead to unauthorized access to sensitive corporate resources, data breaches, and further exploitation within the AWS environment. The technique is often employed after initial access through phishing or other credential compromise methods. The impact of successful session hijacking can range from data exfiltration to infrastructure compromise.

Attack Chain

1. The attacker gains initial access to user credentials or session cookies, possibly through phishing (T1566) or malware.
2. The attacker leverages the compromised credentials/session cookies to authenticate to the AWS environment.
3. The attacker initiates AWS API calls, such as DescribeEventAggregates, from their location.
4. The legitimate user also continues to use their AWS session from their original location.
5. AWS CloudTrail logs record the DescribeEventAggregates events, noting the originating IP addresses and user identities.
6. A monitoring system detects multiple DescribeEventAggregates events for the same user originating from different IP addresses within a 5-minute window.
7. The attacker gains unauthorized access to AWS resources.
8. The attacker performs malicious actions such as data exfiltration or resource modification.

Impact

Compromised AWS IAM accounts can lead to significant data breaches, unauthorized resource usage, and potential disruptions to cloud services. The impact can range from exfiltration of sensitive data to modification or deletion of critical infrastructure components. Organizations in all sectors are at risk if their AWS credentials are compromised. A successful attack could result in data loss, financial damage, and reputational harm.

Recommendation

• Deploy the Sigma rule AWS Concurrent Sessions From Different IPs to your SIEM and tune it for your environment to detect potential session hijacking attempts using AWS CloudTrail logs.
• Investigate any alerts generated by the Sigma rule AWS Concurrent Sessions From Different Ips to determine if the concurrent sessions are legitimate or malicious.
• Implement multi-factor authentication (MFA) for all AWS IAM users to mitigate credential theft and session hijacking (reference T1185).
• Monitor AWS CloudTrail logs for unusual API calls and access patterns to detect potentially compromised accounts.
• Review and enforce least privilege access controls to limit the impact of compromised accounts.
• Consider using AWS IAM Access Analyzer to identify overly permissive IAM roles and policies.