Attack Chain

1. Initial Access: The attacker gains access to an AWS account through compromised credentials or a misconfigured IAM role.
2. Reconnaissance: The attacker uses the AWS CLI or SDK to query for deprecated AMIs via the DescribeImages API call, setting the includeDeprecated parameter to "true."
3. Discovery: The attacker analyzes the results of the DescribeImages API call to identify deprecated AMIs that may be vulnerable to exploitation.
4. Vulnerability Assessment: The attacker researches the identified deprecated AMIs for known vulnerabilities and exploits.
5. Resource Provisioning: The attacker attempts to launch an EC2 instance using a deprecated AMI, potentially bypassing security controls due to the AMI's age.
6. Privilege Escalation/Lateral Movement: If the deprecated AMI contains vulnerable software, the attacker exploits it to gain elevated privileges or move laterally within the AWS environment.
7. Data Exfiltration/Impact: The attacker uses the compromised EC2 instance to exfiltrate sensitive data or cause disruption to AWS services.

Impact

A successful attack leveraging deprecated AMIs can lead to the compromise of EC2 instances, data breaches, and service disruptions. While this event by itself is low severity, it can act as a part of a larger attack and indicate the early stages of cloud reconnaissance. The impact of exploiting vulnerable AMIs includes data exfiltration, service downtime, and unauthorized access to other AWS resources.

Recommendation

• Deploy the Sigma rule AWS EC2 Deprecated AMI Discovery to your SIEM to detect queries for deprecated AMIs and tune for your environment.
• Review the source IP address (source.ip) of the request to identify potentially suspicious origins as per the AWS EC2 Deprecated AMI Discovery rule.
• Restrict IAM permissions to prevent unauthorized access to deprecated AMIs as mentioned in the investigation steps.
• Enable alerts for future queries involving deprecated AMIs or other unusual API activity within CloudTrail logs as mentioned in the remediation steps.