{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/amazon-cloudfront/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AWS","AWS CloudTrail","Amazon EC2","AWS IAM","Amazon S3","AWS KMS","Amazon RDS","AWS Lambda","Amazon DynamoDB","Amazon CloudFront","AWS Elastic Load Balancing","AWS Organizations","AWS STS","AWS SES"],"_cs_severities":["low"],"_cs_tags":["cloud","aws","discovery","reconnaissance","cli"],"_cs_type":"advisory","_cs_vendors":["Amazon"],"content_html":"\u003cp\u003eAn Elastic detection rule flags suspicious AWS CloudTrail activity where a single AWS resource executes more than five unique discovery API calls (e.g., \u003ccode\u003eDescribe*\u003c/code\u003e, \u003ccode\u003eList*\u003c/code\u003e, \u003ccode\u003eGet*\u003c/code\u003e, \u003ccode\u003eGenerate*\u003c/code\u003e) within a 10-second window. This behavior, often originating from the AWS Command Line Interface (CLI), is a strong indicator of an adversary performing reconnaissance after gaining initial access through compromised credentials or an exploited EC2 instance. Threat actors leverage such rapid, diverse API enumeration to map the target's AWS infrastructure, identify valuable assets, and pinpoint potential weak points for subsequent exploitation. This activity represents an early stage of compromise, providing valuable insights into the attacker's understanding of the environment and their potential next moves. Organizations should prioritize investigation of such alerts to prevent deeper intrusions and data exfiltration.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Access\u003c/strong\u003e: An attacker gains initial access to an AWS environment, typically via compromised AWS credentials (e.g., IAM user access keys) or by compromising an existing EC2 instance.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eEnvironment Setup\u003c/strong\u003e: From the compromised resource or system, the attacker utilizes the AWS Command Line Interface (CLI) to interact with the AWS API.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eBroad Enumeration\u003c/strong\u003e: The attacker begins to execute multiple read-only API calls across various AWS services such as EC2, IAM, S3, KMS, RDS, Lambda, DynamoDB, CloudFront, Elastic Load Balancing, STS, SES, and Organizations.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRapid Discovery\u003c/strong\u003e: Within a brief 10-second window, the attacker executes more than five distinct API actions, specifically focusing on \u003ccode\u003eDescribe*\u003c/code\u003e, \u003ccode\u003eList*\u003c/code\u003e, \u003ccode\u003eGet*\u003c/code\u003e, and \u003ccode\u003eGenerate*\u003c/code\u003e operations to gather information.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eInformation Gathering\u003c/strong\u003e: The attacker collects extensive details about the AWS environment, including running instances, user roles, bucket configurations, key management service details, and other resource metadata.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eTarget Identification\u003c/strong\u003e: The gathered information is then used to build a comprehensive understanding of the infrastructure, identify valuable data stores, discover misconfigurations, and pinpoint specific targets for further privilege escalation, lateral movement, or data exfiltration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eIf this discovery phase succeeds undetected, attackers can gain a deep understanding of the targeted AWS infrastructure, enabling them to identify critical assets, sensitive data, and exploitable misconfigurations. This knowledge significantly facilitates subsequent stages of an attack, such as privilege escalation, lateral movement, data exfiltration, or resource hijacking for cryptocurrency mining. The impact can range from unauthorized data access and financial loss to complete compromise of cloud environments, disruption of services, and reputational damage. While this specific detection identifies an early reconnaissance phase, its successful execution directly increases the likelihood and severity of subsequent, more damaging attacks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided ESQL detection logic (or similar behavioral analytics) to your SIEM, focusing on \u003ccode\u003eaws.cloudtrail\u003c/code\u003e logs, to detect multiple distinct discovery API calls within short timeframes.\u003c/li\u003e\n\u003cli\u003eMonitor \u003ccode\u003eaws.cloudtrail\u003c/code\u003e logs for \u003ccode\u003euser_agent.name\u003c/code\u003e indicating \u003ccode\u003eaws-cli\u003c/code\u003e and evaluate its behavior, especially from \u003ccode\u003esource.ip\u003c/code\u003e that are external or unusual for the identity.\u003c/li\u003e\n\u003cli\u003eInvestigate alerts by examining the \u003ccode\u003eaws.cloudtrail.user_identity.arn\u003c/code\u003e to determine if the activity is legitimate automation or an unexpected identity.\u003c/li\u003e\n\u003cli\u003eReview the \u003ccode\u003eevent.action\u003c/code\u003e and \u003ccode\u003eevent.provider\u003c/code\u003e values in flagged incidents to understand which AWS services and discovery APIs are being targeted.\u003c/li\u003e\n\u003cli\u003eImplement strong Identity and Access Management (IAM) policies, including multi-factor authentication (MFA) for all users, to prevent compromised credentials from being used for reconnaissance.\u003c/li\u003e\n\u003cli\u003eRegularly audit IAM access keys and rotate them, especially if \u003ccode\u003eaws.cloudtrail.user_identity.access_key_id\u003c/code\u003e is identified in suspicious activity.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-20T13:07:53Z","date_published":"2026-07-20T13:07:53Z","id":"https://feed.craftedsignal.io/briefs/2026-07-aws-discovery-cli-resource/","summary":"An Elastic detection rule identifies when a single AWS identity, using the AWS CLI, performs more than five distinct read-only discovery API calls (such as Describe*, List*, Get*, and Generate*) across various AWS services within a 10-second window, indicating reconnaissance by an adversary using compromised credentials or an exploited EC2 instance to map the AWS infrastructure for potential targets and further exploitation.","title":"AWS CLI Discovery from Single Resource","url":"https://feed.craftedsignal.io/briefs/2026-07-aws-discovery-cli-resource/"}],"language":"en","title":"CraftedSignal Threat Feed - Amazon CloudFront","version":"https://jsonfeed.org/version/1.1"}