AWS DynamoDB Table Export to S3 Detection

This alert detects the ExportTableToPointInTime operation in AWS CloudTrail logs, specifically when a user or role performs this action for the first time. Adversaries may leverage this operation to collect sensitive data or exfiltrate entire DynamoDB tables to S3 buckets for unauthorized access or analysis. This activity can be a precursor to data breaches or indicative of compromised credentials. The detection focuses on the initial observation of this action to reduce false positives and highlight potentially anomalous behavior that requires investigation. The targeted logs are AWS CloudTrail logs.

Attack Chain

1. An attacker gains unauthorized access to an AWS account, potentially through compromised credentials or an exposed IAM role.
2. The attacker enumerates DynamoDB tables within the AWS environment to identify targets containing sensitive information.
3. The attacker executes the ExportTableToPointInTime API call to export a DynamoDB table to an S3 bucket. This requires appropriate IAM permissions.
4. The exported data is stored in the designated S3 bucket in a format suitable for offline analysis.
5. The attacker accesses the exported data from the S3 bucket.
6. The attacker exfiltrates the data from the S3 bucket.
7. The attacker analyzes or uses the exfiltrated data for malicious purposes.

Impact

A successful attack could lead to the exfiltration of sensitive data stored in DynamoDB tables, including customer information, financial records, or proprietary business data. This can result in significant financial losses, reputational damage, and legal liabilities for the affected organization. The number of affected records would depend on the size of the exported DynamoDB table. Organizations in all sectors are potentially at risk if they use DynamoDB to store sensitive information.

Recommendation

• Deploy the Sigma rule Detect First Time DynamoDB Table Export to S3 to your SIEM, focusing on the aws.cloudtrail data stream, to identify initial instances of this activity.
• Investigate any alerts generated by the Sigma rule, focusing on the aws.cloudtrail.user_identity.arn, source.ip, and aws.cloudtrail.request_parameters fields to understand the context of the export operation.
• Review IAM policies to ensure that users and roles have the appropriate least-privilege access to DynamoDB tables, preventing unauthorized export operations.
• Monitor the cloud.account.id and user.name fields flagged by the new_terms rule to ensure that only authorized accounts and users are performing DynamoDB table exports.