https://feed.craftedsignal.io/tags/ami/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 03 May 2024 14:22:00 +0000https://feed.craftedsignal.io/briefs/2024-05-aws-ami-shared-account/Fri, 03 May 2024 14:22:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-05-aws-ami-shared-account/An AWS Amazon Machine Image (AMI) being shared with another AWS account could indicate data exfiltration, as AMIs may contain sensitive data, and unauthorized sharing can lead to exposure.This alert detects when an Amazon Machine Image (AMI) is shared with another AWS account. While AMI sharing is a legitimate AWS feature, it can be abused by adversaries to exfiltrate sensitive data. AMIs often contain secrets, bash histories, code artifacts, and other sensitive data. An attacker with sufficient privileges can share an AMI with an external account under their control, effectively copying the data out of the targeted AWS environment. This rule helps identify potentially malicious AMI sharing activity. Note that AWS Marketplace subscriptions and other AWS services like workspaces.amazonaws.com and backup.amazonaws.com will legitimately invoke AMI sharing. Review such service-invoked events to confirm they match legitimate and intended sharing configurations.

Attack Chain

1. An attacker gains initial access to an AWS account with sufficient privileges to modify AMI attributes. This could be through compromised credentials, an insider threat, or exploiting a misconfigured IAM role.
2. The attacker identifies a target AMI containing sensitive data within the AWS environment.
3. The attacker uses the ModifyImageAttribute API call to add a new user ID to the AMI's launch permissions, specifically the AWS account ID of an account controlled by the attacker. The aws.cloudtrail.request_parameters field will contain the add parameter with the target account.
4. The AWS EC2 service processes the ModifyImageAttribute request, granting the specified account access to the AMI.
5. The attacker, logged into the external AWS account, verifies they can now access the shared AMI.
6. The attacker copies the AMI to their own AWS account.
7. The attacker launches an EC2 instance from the copied AMI in their own account.
8. The attacker accesses and exfiltrates the sensitive data contained within the AMI, achieving their objective of data theft.

Impact

Successful exfiltration of an AMI can lead to the compromise of sensitive data, including credentials, code, and configuration information. This could result in unauthorized access to other systems, data breaches, and reputational damage. The number of victims depends on the scope of data contained within the AMI. Targeted sectors could vary depending on the compromised account's role.

Recommendation

• Deploy the "AWS EC2 AMI Shared with Another Account" Sigma rule to your SIEM and tune for your environment (rule).
• Investigate any detected AMI sharing events, focusing on the aws.cloudtrail.request_parameters and aws.response.response_elements fields in CloudTrail logs to identify the AMI ID and the user ID of the account with which the AMI was shared (content).
• Review and, if necessary, revoke unauthorized shared permissions from the AMI immediately (content).
• Implement monitoring to track changes to shared AMIs and alert on unauthorized access patterns (content).
• Refer to the Amazon EC2 User Guide on AMIs and Sharing AMIs for more information on managing and sharing AMIs (references).

]]>mediumadvisoryawsamiexfiltrationhttps://feed.craftedsignal.io/briefs/2024-01-aws-ami-exfiltration/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-aws-ami-exfiltration/An attacker modifies AWS AMI attributes, potentially sharing an AMI with another AWS account or making it publicly accessible, to exfiltrate sensitive data stored in AWS resources.An attacker leverages compromised AWS credentials or exploits a misconfigured IAM role to modify Amazon Machine Image (AMI) attributes. This modification can involve sharing the AMI with an external AWS account or making it publicly accessible. The primary goal is to exfiltrate sensitive data stored within the AMI, such as proprietary code, customer data, or internal configurations. This activity is particularly concerning due to the potential for unauthorized access to critical resources and subsequent data breaches. The technique abuses legitimate AWS functionality, making it harder to detect without specific monitoring in place. The sharing of AMI's is a common tactic to enable data exfiltration by threat actors.

Attack Chain

1. Initial Compromise: The attacker gains access to an AWS account through compromised credentials, exploiting a vulnerability in a web application, or leveraging a misconfigured IAM role.
2. Enumeration: The attacker enumerates available AMIs within the AWS environment to identify those containing sensitive data.
3. Privilege Escalation (If Needed): If the initial access doesn't have sufficient privileges, the attacker attempts to escalate privileges to gain the ability to modify AMI attributes.
4. AMI Attribute Modification: The attacker uses the ModifyImageAttribute API call to modify the AMI's launch permissions. This involves adding external AWS accounts or setting the group to "all", making the AMI public.
5. Data Exfiltration: The attacker or a collaborator in the external AWS account copies the now-shared AMI to their own environment.
6. Data Extraction: The attacker launches an EC2 instance from the copied AMI and extracts the sensitive data stored within it.
7. Cleanup (Optional): The attacker may attempt to remove CloudTrail logs or other evidence of their activity to hinder detection.
8. Lateral Movement or Further Attacks: The attacker uses the exfiltrated data for further attacks, such as lateral movement within the organization's network or direct extortion.

Impact

A successful AMI attribute modification and exfiltration can lead to significant data breaches, exposing sensitive customer data, proprietary code, or internal configurations. This can result in financial losses, reputational damage, legal liabilities, and regulatory fines. The scope of the impact depends on the sensitivity and volume of data stored within the compromised AMIs. This technique directly targets data confidentiality and integrity, potentially affecting thousands or millions of users if customer data is involved.

Recommendation

• Enable and monitor AWS CloudTrail logs for ModifyImageAttribute API calls (AWS CloudTrail ModifyImageAttribute Data Source).
• Deploy the provided Sigma rule to detect suspicious AMI attribute modifications in your SIEM (Sigma Rule: "Detect Publicly Shared AWS AMI").
• Implement strict IAM policies to limit the ability to modify AMI attributes to only authorized personnel (Reference: https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/).
• Regularly review AMI launch permissions to identify any publicly shared or externally shared AMIs (Reference: https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/).
• Configure AWS Config rules to automatically detect and remediate publicly shared AMIs (Reference: https://stratus-red-team.cloud/attack-techniques/AWS/aws.exfiltration.ec2-share-ami/).
• Alert on users who are modifying AMI attributes and do not typically perform that action.

]]>highadvisoryawsamidata-exfiltrationcloudtrail