Detection of AWS EC2 Deprecated AMI Discovery

This detection brief addresses the reconnaissance technique where an AWS identity queries for deprecated Amazon Machine Images (AMIs). Attackers often perform this discovery during the post-compromise or initial access phases to identify outdated or unpatched system images that may contain known vulnerabilities. By leveraging the DescribeImages API call with the includeDeprecated parameter set to true, an adversary can enumerate images that are no longer recommended for use but may still be available in the environment. While these queries are not inherently malicious and can occur during legitimate maintenance or security assessments, they provide a strong signal of unauthorized discovery when originating from unexpected identities or sources. Defenders should monitor these API calls to correlate them with subsequent instance launch activity or lateral movement attempts within the AWS account.

Impact

Successful reconnaissance of deprecated AMIs can lead to the identification of legacy systems that lack critical security patches, potentially exposing the environment to RCE or privilege escalation if an attacker manages to launch and compromise these instances. Monitoring this activity assists in reducing the attack surface by identifying images that should be decommissioned or restricted via IAM policies.

Recommendation

• Deploy the provided detection rule to monitor CloudTrail logs for the DescribeImages API action with the includeDeprecated parameter enabled.
• Restrict IAM permissions for the ec2:DescribeImages action to ensure only authorized service principals and administrators can perform these lookups.
• Perform a quarterly audit of all AMIs in use within the AWS environment to identify and replace deprecated images with current, hardened versions.
• Use the aws.cloudtrail.user_identity.arn and source.ip fields to investigate the context of flagged queries, cross-referencing these with any subsequent RunInstances API calls.