Alert-Spike - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/alert-spike/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 12:00:00 +0000Spike in AWS Security Hub Alerts for EC2 Instancehttps://feed.craftedsignal.io/briefs/2024-01-aws-security-hub-spike/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-aws-security-hub-spike/Detects a sudden increase in security alerts generated by AWS Security Hub related to a specific EC2 instance, potentially indicating active compromise or misconfiguration.This detection focuses on identifying a surge of alerts originating from AWS Security Hub concerning a particular EC2 instance. A sudden spike in security findings could signify an ongoing attack, a recently introduced vulnerability, or a misconfiguration that's triggering multiple security checks. It's important to note that this detection is triggered by the number of alerts, not the specific type. While this brief is based on the name of a Splunk detection, it's adapted for broader applicability. An abrupt increase in alerts is a statistically significant anomaly that requires further investigation.

Attack Chain

  1. Initial Access: An attacker gains initial access through a compromised credential or exploiting a vulnerability (e.g., CVE-2023-XXXX in a web application running on the EC2 instance).
  2. Privilege Escalation: The attacker attempts to escalate privileges within the EC2 instance, potentially using tools like sudo or exploiting kernel vulnerabilities.
  3. Lateral Movement: The attacker uses the compromised EC2 instance to move laterally to other resources within the AWS environment, utilizing stolen AWS credentials or exploiting misconfigured IAM roles.
  4. Persistence: The attacker establishes persistence by creating new user accounts, installing backdoors (e.g., through modified SSH configurations), or scheduling malicious tasks via cron.
  5. Data Exfiltration: The attacker begins exfiltrating sensitive data from the EC2 instance to an external server using tools like aws s3 cp or scp.
  6. Command and Control: The attacker establishes a command and control (C2) channel with an external server, allowing them to remotely control the compromised EC2 instance. This may involve using protocols like HTTP or DNS.
  7. Resource Hijacking: The attacker leverages the compromised EC2 instance for malicious purposes such as cryptomining or launching DDoS attacks.

Impact

A successful attack leading to a spike in Security Hub alerts could result in data breaches, financial losses, reputational damage, and disruption of services. The compromised EC2 instance could be used as a launchpad for further attacks within the AWS environment. The number of affected users and the severity of the impact depend on the data stored on the compromised instance and the attacker's objectives.

Recommendation

  • Implement the Sigma rule Detect Spike in AWS Security Hub Alerts for EC2 Instance to identify potential compromises based on alert volume.
  • Investigate any alerts triggered by the Sigma rule by examining AWS CloudTrail logs to determine the root cause of the alert spike and the actions taken by the attacker.
  • Review and harden IAM roles associated with the EC2 instance to prevent lateral movement (reference the "Lateral Movement" step in the Attack Chain).
  • Implement network segmentation to limit the blast radius of a compromised EC2 instance (reference the "Lateral Movement" step in the Attack Chain).
]]>mediumadvisorycloudawssecurityhubec2alert-spike