Aws — CraftedSignal Threat Feed

AWS SSM Session Manager Child Process Execution Abuse

hello@craftedsignal.io — Fri, 01 May 2026 20:57:28 +0000

AWS Systems Manager (SSM) Session Manager provides interactive shell access to EC2 instances and hybrid nodes without the need for bastion hosts or open inbound ports. Attackers can abuse this functionality by leveraging compromised AWS credentials or IAM roles with ssm:StartSession permissions to gain unauthorized access to target systems. This allows for remote execution of commands and lateral movement within the AWS environment. The technique involves spawning child processes from the SSM session worker process to perform malicious activities. Defenders should monitor for unusual process execution patterns originating from SSM sessions to identify potential abuse.

Attack Chain

Attacker gains access to valid AWS credentials or IAM role with ssm:StartSession permissions.
Attacker initiates an SSM session to a target EC2 instance or hybrid node using the compromised credentials.
The ssm-session-worker process is started on the target instance to manage the interactive session.
Attacker executes commands within the session, spawning child processes from the ssm-session-worker process.
Attacker may use scripting languages such as PowerShell or Bash to execute malicious code (e.g., using awsrunPowerShellScript or awsrunShellScript).
These scripts perform reconnaissance, download additional tools, or attempt credential access.
Attacker moves laterally to other instances or resources within the AWS environment.
The ultimate objective is often data exfiltration, privilege escalation, or maintaining persistent access.

Impact

Successful exploitation can lead to unauthorized access to sensitive data, compromise of critical systems, and lateral movement within the AWS environment. The impact can range from data breaches to complete control of the compromised infrastructure. The number of affected systems depends on the scope of the compromised credentials and the attacker’s ability to move laterally. Organizations using AWS SSM are at risk.

Recommendation

Deploy the Sigma rules in this brief to your SIEM and tune for your environment to detect suspicious child processes spawned by ssm-session-worker.
Correlate process activity with AWS CloudTrail logs for StartSession and related API calls to identify the IAM principal initiating the session (see the overview section for API names).
Implement strict IAM policies and regularly review AWS credentials to minimize the risk of credential compromise.
Monitor process.command_line, process.executable, process.user.name for unusual activity within SSM sessions.

AWS IAM Privilege Operations via Lambda Execution Role

hello@craftedsignal.io — Fri, 01 May 2026 20:57:28 +0000

This threat focuses on the abuse of AWS Lambda execution roles to perform sensitive IAM operations. Lambda functions, often running with over-permissioned roles, can be exploited by adversaries to escalate privileges and establish persistence within an AWS environment. An attacker gaining control of a Lambda function can leverage its execution role to make IAM API calls that would normally require elevated permissions. This includes creating new IAM users or roles, attaching policies to existing IAM entities, and modifying EC2 instance profiles. The scope of this threat includes any AWS environment utilizing Lambda functions with IAM permissions.

Attack Chain

An attacker gains unauthorized access to a Lambda function, either through code injection, vulnerable dependencies, or misconfiguration.
The attacker leverages the Lambda function’s execution role, which has excessive IAM permissions.
The attacker executes IAM API calls, such as CreateUser, CreateRole, or CreateAccessKey, to create new IAM identities.
The attacker uses AttachUserPolicy, PutUserPolicy, AttachRolePolicy, or PutRolePolicy to grant elevated permissions to the newly created or existing IAM identities.
The attacker modifies instance profiles using CreateInstanceProfile and AddRoleToInstanceProfile to prepare EC2 instances for lateral movement.
The attacker uses the newly created or modified IAM identities to assume roles and access resources they were not previously authorized to access via sts:AssumeRole.
The attacker achieves privilege escalation, gaining control over sensitive AWS resources and services.
The attacker establishes persistence by creating rogue IAM users, roles, or access keys.

Impact

A successful attack can lead to full compromise of the AWS environment. An attacker could create highly privileged IAM users and roles, granting them the ability to access and control all AWS resources. This can result in data breaches, service disruptions, and financial losses. The impact is magnified in environments where Lambda functions are heavily relied upon for critical business operations.

Recommendation

Deploy the Sigma rule “AWS IAM Sensitive Operations via Lambda Execution Role” to your SIEM and tune for your environment to detect the described IAM API calls originating from Lambda execution roles.
Review and restrict the permissions granted to Lambda execution roles, following the principle of least privilege, to minimize the potential impact of a compromised function.
Monitor aws.cloudtrail.user_identity.arn to identify the Lambda function and associated deployment path responsible for the IAM API calls.
Investigate aws.cloudtrail.request_parameters for targets such as userName, groupName, roleName, policyArn, or instanceProfileName to understand the scope of the IAM operations.
Revoke or rotate the credentials of any compromised Lambda execution roles to prevent further unauthorized access.
Remediate any rogue IAM users, roles, or access keys created by the attacker to eliminate persistence mechanisms.

AWS EC2 Role GetCallerIdentity from New Source AS Organization

hello@craftedsignal.io — Fri, 01 May 2026 20:57:28 +0000

This detection identifies when an EC2 instance role session calls the AWS STS GetCallerIdentity API from a source Autonomous System (AS) Organization name that has not been previously observed. The GetCallerIdentity API is often used by adversaries to validate stolen instance role credentials from infrastructure outside the victim’s normal egress points. By baselining the combination of identity and source network, the rule reduces noise associated with stable NAT or AWS-classified egress, focusing on truly novel access patterns. This detection is specifically designed to complement other rules that may detect general GetCallerIdentity calls, by excluding previously seen combinations of user identity and source AS organization.

Attack Chain

An attacker gains unauthorized access to an EC2 instance through methods like exploiting a Server-Side Request Forgery (SSRF) vulnerability, compromising application code or exploiting IMDS abuse.
The attacker leverages the instance’s IAM role to obtain temporary AWS credentials.
The attacker attempts to validate the stolen credentials using the GetCallerIdentity API call.
The GetCallerIdentity API call originates from an IP address associated with a new and unexpected Autonomous System Organization (ASO).
The AWS CloudTrail logs record the GetCallerIdentity event, including the user identity ARN and the source AS organization name.
The detection rule triggers due to the new combination of user identity and source AS organization.
The attacker uses the validated credentials to perform reconnaissance and identify valuable resources within the AWS environment (e.g., S3 buckets, databases).
The attacker attempts to exfiltrate sensitive data or deploy malicious workloads using the stolen credentials.

Impact

A successful attack can lead to unauthorized access to sensitive data stored within the AWS environment. The attacker may be able to escalate privileges, compromise other resources, and disrupt services. The potential impact includes data breaches, financial loss, and reputational damage. The lack of specific victim counts or sectors targeted suggests a broad applicability across various AWS users.

Recommendation

Deploy the Sigma rule “AWS EC2 Role GetCallerIdentity from New Source AS Organization” to your SIEM to detect suspicious activity.
Investigate alerts triggered by the Sigma rule, focusing on the aws.cloudtrail.user_identity.arn and source.as.organization.name fields.
Monitor AWS CloudTrail logs for GetCallerIdentity API calls, particularly those originating from unfamiliar source IP addresses and ASNs.
Revoke compromised IAM role sessions by stopping the affected EC2 instances or removing the role from the instance profile.
Rotate any long-lived secrets accessible by the EC2 instance, based on the aws.cloudtrail.user_identity.access_key_id.

AWS Discovery API Calls from VPN ASN by New Identity

hello@craftedsignal.io — Fri, 01 May 2026 20:57:28 +0000

This detection identifies the first-time occurrence of an IAM principal invoking discovery APIs from a source IP address associated with a known VPN autonomous system number (ASN). The rule focuses on high-signal discovery actions, such as credential checks, account enumeration, bucket inventory, compute inventory, and logging introspection within AWS CloudTrail logs. The goal is to detect potential reconnaissance activities originating from anonymizing networks, which may indicate malicious intent. The rule specifically omits broad List* and Describe* patterns to reduce false positives, focusing instead on a curated list of ASNs commonly associated with VPN providers and hosting services. It’s important to validate ASN data using local intelligence and tailor the event.action list based on your environment’s baseline. Hosting ASNs are dual-use and require careful monitoring.

Attack Chain

An attacker gains unauthorized access to AWS credentials, possibly through compromised credentials or misconfigured IAM roles.
The attacker initiates a VPN connection to mask their origin and evade geographic restrictions or monitoring. The VPN endpoint’s ASN belongs to a known VPN provider.
Using the compromised credentials and VPN connection, the attacker calls the AWS API to execute GetCallerIdentity to validate access.
The attacker enumerates IAM users and roles using ListUsers and ListRoles to map out the AWS environment’s identity landscape.
The attacker inventories S3 buckets using ListBuckets to identify potential targets for data exfiltration or manipulation.
The attacker gathers information about EC2 instances, VPCs, and security groups using DescribeInstances, DescribeVpcs, and DescribeSecurityGroups to understand the network infrastructure.
The attacker lists available Lambda functions using ListFunctions to discover potential code execution opportunities.
The attacker collects logging configurations by calling DescribeTrails to identify logging gaps.

Impact

A successful attack leveraging these discovery techniques can lead to unauthorized access to sensitive data, privilege escalation, and lateral movement within the AWS environment. By mapping out the cloud infrastructure, attackers can identify vulnerabilities and misconfigurations to exploit. Compromised AWS environments can result in data breaches, service disruptions, and financial losses.

Recommendation

Deploy the Sigma rule AWS Discovery API Calls from VPN ASN by New Identity to detect anomalous discovery activity originating from VPN ASNs.
Review the curated list of VPN-oriented ASNs within the rule query and update it with local intelligence from sources like RIPE, BGPView, or PeeringDB.
Enable AWS CloudTrail logs to capture the necessary event data for the Sigma rule to function effectively.
Tune the Sigma rule’s event.action filter to include additional discovery-related API calls relevant to your environment, based on baseline analysis.
Investigate alerts generated by the Sigma rule by examining aws.cloudtrail.user_identity.arn, event.action, event.provider, source.ip, and source.as.organization.name.
Implement automated response actions, such as revoking sessions or rotating keys, when unexpected discovery activity is detected from VPN ASNs.

Rapid Enumeration of AWS S3 Buckets

hello@craftedsignal.io — Fri, 01 May 2026 19:43:38 +0000

This threat brief covers suspicious activity related to the rapid enumeration of AWS S3 buckets. The activity is characterized by an AWS principal invoking read-only S3 control-plane APIs from the same source IP address within a short timeframe. This pattern is often associated with reconnaissance efforts, security scanning tools, or post-compromise enumeration activities. The behavior is similar to that observed with CSPM tools and by threat actors like Team PCP. The detection specifically excludes AWS service principals and requires programmatic-style sessions (i.e., not Management Console credentials). It focuses on scenarios where resource and identity fields are populated to avoid skewed results from null values. The detection threshold is set to greater than 15 distinct aws.cloudtrail.resources.arn values within a 10-second window.

Attack Chain

An attacker gains initial access to an AWS environment using compromised credentials or through an exposed IAM role. (T1530)
The attacker authenticates to AWS using the obtained credentials, creating a programmatic session.
The attacker issues a series of GetBucketAcl, GetBucketPublicAccessBlock, GetBucketPolicy, GetBucketPolicyStatus, and GetBucketVersioning API calls to S3.
These API calls are directed towards multiple distinct S3 buckets within a short timeframe (10 seconds).
The attacker collects information about the bucket’s access control lists (ACLs), public access blocks, policies, versioning status, and other metadata. (T1526, T1580, T1619)
The collected information is analyzed to identify publicly accessible buckets, misconfigurations, or sensitive data storage locations.
The attacker uses identified vulnerabilities to exfiltrate data.
The attacker attempts lateral movement within the AWS environment, leveraging the discovered information to compromise other resources.

Impact

Successful enumeration of S3 buckets can lead to the discovery of sensitive data, misconfigurations, and publicly accessible resources. This can result in data breaches, unauthorized access, and further compromise of the AWS environment. The enumeration allows an attacker to map out the S3 storage landscape, identifying targets for data exfiltration or privilege escalation. The rapid nature of the enumeration suggests automated scanning or reconnaissance, potentially indicating a larger attack campaign.

Recommendation

Deploy the following Sigma rule to detect rapid S3 bucket enumeration activity based on AWS CloudTrail logs, adjusting the threshold of 15 distinct buckets to suit your environment.
Investigate any alerts generated by the Sigma rule, focusing on the source IP address (source.ip), AWS principal ARN (aws.cloudtrail.user_identity.arn), and the list of accessed buckets (aws.cloudtrail.resources.arn).
Review IAM policies associated with the identified principal to ensure least privilege for S3 read APIs.
Monitor CloudTrail logs for related events, such as ListBuckets, GetObject, PutBucketPolicy, AssumeRole, or IAM changes, occurring within ±30 minutes of the detected enumeration activity.
Implement network-level restrictions on the source IP address if it is not authorized to perform S3 enumeration.
Document approved scanning accounts and add user agent filters to the provided Sigma rule to reduce noise from those identities.

AWS Discovery API Calls via CLI from a Single Resource

hello@craftedsignal.io — Fri, 01 May 2026 19:43:38 +0000

This detection rule identifies suspicious AWS reconnaissance activity originating from the AWS CLI. It triggers when a single AWS identity (IAM user, role, or service principal) makes more than five unique discovery-related API calls (such as Describe*, List*, Get*, or Generate*) within a 10-second window. The rule is designed to detect adversaries attempting to map out an AWS environment after gaining unauthorized access through compromised credentials or a compromised EC2 instance. The tool focuses on API calls related to key AWS services like EC2, IAM, S3, and KMS. This rule helps defenders identify and respond to early-stage reconnaissance activity, preventing further exploitation or data exfiltration. The rule excludes activity from AWS service accounts and the AWS Management Console, and it requires a minimum stack version of 9.2.0 with AWS integration version 4.6.0.

Attack Chain

Initial Access: An attacker gains access to an AWS environment, potentially through compromised credentials or by compromising an EC2 instance.
Credential Usage: The attacker leverages the AWS CLI to interact with the AWS environment using the compromised credentials.
Reconnaissance: The attacker initiates a series of discovery API calls to gather information about the AWS infrastructure. This includes using Describe*, List*, Get*, and Generate* commands.
Resource Enumeration: The attacker enumerates various AWS resources, including EC2 instances, IAM roles, S3 buckets, and KMS keys, by querying their respective APIs.
Target Identification: The attacker analyzes the gathered information to identify potential targets for further exploitation, such as vulnerable EC2 instances or misconfigured S3 buckets.
Privilege Escalation (Optional): If the compromised credentials have limited permissions, the attacker might attempt to escalate privileges to gain broader access to the AWS environment.
Lateral Movement (Optional): The attacker might attempt to move laterally to other AWS accounts or services to expand their reach and impact.
Data Exfiltration/Impact: Based on the attacker’s goals, they may attempt to exfiltrate sensitive data or cause disruption by modifying or deleting resources.

Impact

Successful exploitation could lead to unauthorized access to sensitive data, such as customer information, intellectual property, or financial records. The attacker could also disrupt business operations by modifying or deleting critical resources. Identifying and responding to such activity in a timely manner can help prevent significant damage and maintain the security and integrity of the AWS environment.

Recommendation

Deploy the following Sigma rule to your SIEM and tune for your environment to detect the described reconnaissance activity.
Enable AWS CloudTrail logging for all AWS regions and accounts in your organization to ensure the required logs are available for detection.
Investigate any alerts generated by the Sigma rule, focusing on identifying the affected AWS identity, the source IP address, and the specific API calls made (as captured by the Sigma rule).
If suspicious activity is confirmed, follow AWS’s incident-handling guidance, including disabling or rotating the access key used and restricting outbound connectivity from the source (reference the AWS Security Incident Response Guide).

AWS Credentials Used from GitHub Actions and Non-CI/CD Infrastructure

hello@craftedsignal.io — Wed, 22 Apr 2026 17:45:55 +0000

This threat involves the unauthorized use of AWS credentials stolen from GitHub Actions secrets. Attackers exfiltrate these credentials and use them from their own infrastructure, bypassing the intended CI/CD environment. The activity is detected by observing AWS access keys appearing in CloudTrail logs originating from both legitimate GitHub Actions runners (identified by Microsoft ASN or the github-actions user agent string) and suspicious infrastructure outside the expected CI/CD provider ASNs (Amazon, Google, Microsoft). This indicates a breach of GitHub repository or organization secrets, leading to potential unauthorized access and control over AWS resources. This activity can begin with compromised Github accounts.

Attack Chain

An attacker gains unauthorized access to a GitHub repository or organization with AWS credentials stored as secrets.
The attacker exfiltrates the AWS access key ID and secret access key, either manually or through automated means, such as modifying a GitHub Action workflow to expose the secrets.
The attacker configures the stolen AWS credentials on their own infrastructure, using tools like the AWS CLI or boto3.
The attacker attempts to authenticate to AWS using the stolen credentials. This generates CloudTrail logs with the attacker’s source IP address and ASN.
The attacker performs reconnaissance activities, such as calling sts:GetCallerIdentity, ListBuckets, DescribeInstances, or ListUsers, to understand the AWS environment and identify potential targets.
The attacker attempts to escalate privileges or move laterally within the AWS environment by exploiting the compromised credentials.
The attacker may create, modify, or delete AWS resources, such as EC2 instances, S3 buckets, or IAM roles, depending on the permissions associated with the stolen credentials.

Impact

Successful exploitation leads to unauthorized access to AWS resources, potentially resulting in data breaches, service disruptions, or financial losses. The impact depends on the permissions associated with the stolen AWS credentials. A single compromised credential could expose sensitive data, disrupt critical services, or allow attackers to deploy malicious infrastructure within the victim’s AWS environment. Identifying and responding to this threat quickly is vital to minimize damages.

Recommendation

Deploy the Sigma rule “AWS Credentials Used from GitHub Actions and Non-CI/CD Infrastructure” to your SIEM and tune for your environment to detect suspicious usage patterns.
Rotate the compromised AWS access key in IAM immediately and update the corresponding GitHub repository/organization secret as described in the rule documentation.
Implement OIDC-based authentication (aws-actions/configure-aws-credentials with role-to-assume) instead of long-lived access keys as mentioned in the rule documentation.
If using OIDC, add IP condition policies to the IAM role trust policy to restrict AssumeRoleWithWebIdentity to known GitHub runner IP ranges, based on the information in the rule documentation.

AWS S3 Rapid Bucket Posture API Calls Indicate Reconnaissance

hello@craftedsignal.io — Sat, 11 Apr 2026 12:00:00 +0000

This threat brief details detection of rapid enumeration of AWS S3 bucket configurations. The activity is characterized by an AWS principal invoking read-only S3 control-plane APIs across numerous buckets within a short timeframe. This pattern is consistent with automated reconnaissance, security scanning, or post-compromise enumeration. The activity is detected by monitoring AWS CloudTrail logs for specific API calls such as GetBucketAcl, GetBucketPublicAccessBlock, GetBucketPolicy, GetBucketPolicyStatus, and GetBucketVersioning. The detection logic excludes AWS service principals and sessions using Management Console credentials to reduce false positives. This activity is relevant for defenders as it can signal early-stage reconnaissance by threat actors like Team PCP, or unauthorized data discovery within the AWS environment. The rule uses a threshold of 15 distinct buckets accessed within 10 seconds to identify suspicious behavior.

Attack Chain

An attacker gains access to AWS credentials, possibly through compromised credentials or misconfigured IAM roles.
The attacker uses the acquired credentials to authenticate to the AWS environment.
The attacker executes a script or tool that calls multiple S3 APIs (e.g., GetBucketAcl, GetBucketPolicy) to gather information about S3 buckets.
The tool iterates through a list of buckets, querying the configuration of each.
The attacker collects the responses from the S3 API calls, mapping out bucket names, permissions, and access control lists.
The attacker analyzes the collected data to identify potentially sensitive data or misconfigured buckets.
Based on the findings, the attacker may proceed to exfiltrate data from accessible buckets (T1530).
The attacker may also attempt to modify bucket policies or access controls to gain further access or persistence.

Impact

Successful reconnaissance of S3 bucket configurations allows attackers to identify vulnerable buckets, potentially leading to data breaches or unauthorized access to sensitive information. The source material does not provide specific victim counts or sectors. However, the impact can range from exposure of confidential data to full compromise of the AWS environment, depending on the level of access gained and the sensitivity of the data stored in the targeted buckets. Identifying the activity early can prevent further exploitation.

Recommendation

Deploy the provided Sigma rule to your SIEM to detect rapid S3 bucket posture API calls (see: “AWS S3 Rapid Bucket Enumeration”).
Review IAM policies and enforce least privilege on S3 read APIs to limit the scope of potential reconnaissance activities.
Monitor CloudTrail logs for the same aws.cloudtrail.user_identity.arn and source.ip within approximately ±30 minutes for follow-on patterns such as ListBuckets, GetObject, PutBucketPolicy, or AssumeRole activities (see Overview).
Rotate or disable keys for the affected identity, revoke active role sessions where possible, and restrict the source IP at the network layer if it is not authorized (see Overview).
Whitelist approved scanning accounts and tune the Sigma rule to reduce noise from those identities (see Overview).

AWS STS GetCallerIdentity API Called for the First Time

hello@craftedsignal.io — Fri, 10 Apr 2026 16:48:32 +0000

The AWS Security Token Service (STS) GetCallerIdentity API allows a user to retrieve information about the IAM user or role associated with the credentials being used. While a legitimate user should already know the account they are operating in, an attacker with compromised credentials may use this API to verify the validity of the credentials and enumerate account details. This activity, especially when observed for the first time from a particular user identity, can indicate malicious reconnaissance. This detection focuses on identifying the initial use of the GetCallerIdentity API, excluding instances where an assumed role is involved due to the common practice of using GetCallerIdentity after assuming a role. This event is flagged as anomalous, potentially signaling unauthorized access or credential misuse within an AWS environment.

Attack Chain

An attacker gains unauthorized access to AWS credentials, either through phishing, credential stuffing, or compromised systems.
The attacker uses the compromised credentials to authenticate to the AWS environment.
The attacker executes the sts:GetCallerIdentity API call to identify the associated AWS account ID, IAM user, or role.
The AWS STS service processes the request and returns the identity information to the attacker.
The attacker analyzes the returned identity information to understand the scope and privileges of the compromised credentials.
The attacker uses the gathered information to perform further reconnaissance activities, such as identifying accessible resources and services.
Based on the discovered information, the attacker may attempt to escalate privileges or move laterally within the AWS environment.
The final objective could include data exfiltration, deployment of malicious workloads, or disruption of services.

Impact

Successful exploitation and undetected reconnaissance can lead to significant damage, including unauthorized access to sensitive data, compromised workloads, and disruption of critical services. The impact can range from data breaches and financial losses to reputational damage and regulatory fines. Depending on the scope of the compromised credentials, the attacker may be able to access and control a large portion of the AWS environment. In the event of a breach, the organization may incur costs related to incident response, data recovery, and legal settlements.

Recommendation

Deploy the Sigma rule “AWS STS GetCallerIdentity API Called for the First Time by New Identity” to your SIEM and tune for your environment to detect anomalous usage of the GetCallerIdentity API.
Investigate any alerts generated by the Sigma rule, focusing on identifying the source IP address, user agent, and the user identity associated with the API call.
Review IAM permission policies for the user identity associated with the GetCallerIdentity API call to ensure the least privilege principle is followed.
Enable AWS CloudTrail logging for all AWS regions in your account to ensure comprehensive event logging, as required by the detection rule.
Consider adding exceptions based on user.id or aws.cloudtrail.user_identity.arn values for automation workflows that legitimately rely on the GetCallerIdentity API, as mentioned in the overview.
Implement multi-factor authentication (MFA) for all IAM users to mitigate the risk of credential compromise, as suggested in the documentation.

AWS SSM Command Document Created by Rare User

hello@craftedsignal.io — Fri, 10 Apr 2026 16:27:52 +0000

This rule identifies when an AWS Systems Manager (SSM) command document is created by a user or role who does not typically perform this action. The rule focuses on detecting anomalous creation of SSM command documents. Adversaries may create SSM command documents to execute commands on managed instances, potentially leading to unauthorized access, command and control, and data exfiltration. The rule utilizes AWS CloudTrail logs to monitor the CreateDocument API call within the SSM service. This activity is flagged when the user or role creating the document deviates from established patterns, indicating a potential security risk. This detection is relevant for organizations using AWS SSM for managing their infrastructure and aims to prevent unauthorized command execution on managed instances.

Attack Chain

An attacker gains initial access to an AWS account, potentially through compromised credentials or an exposed IAM role.
The attacker attempts to create a new SSM Command document using the CreateDocument API call.
The CreateDocument API call is logged by AWS CloudTrail with details about the user identity, request parameters, and document description.
The detection rule analyzes CloudTrail logs, specifically looking for the CreateDocument event with a document type of Command.
The rule identifies the user or role associated with the CreateDocument API call by inspecting the aws.cloudtrail.user_identity.arn field.
If the user or role is considered rare or unusual for creating SSM Command documents within the organization, the rule triggers an alert.
The attacker could then use the created document to execute arbitrary commands on managed instances.
Successful execution of these commands leads to various impacts, including unauthorized access, command and control, data exfiltration, or disruption of services.

Impact

The successful exploitation of this technique can lead to unauthorized access to AWS resources, potentially affecting all systems managed by AWS SSM in the targeted environment. The creation of malicious SSM command documents can lead to data exfiltration, system compromise, or denial of service. If successful, this can impact hundreds or thousands of systems depending on the scope of AWS SSM usage in the organization.

Recommendation

Deploy the Sigma rule “AWS SSM Command Document Created by Rare User” to your SIEM, ensuring proper indexing of CloudTrail logs (index = [“filebeat-*”, “logs-aws.cloudtrail-*”]).
Review the aws.cloudtrail.request_parameters.content field in the CloudTrail logs for any suspicious commands within the created SSM document.
Restrict SSM document creation permissions to specific, trusted roles or users to prevent unauthorized document creation as mentioned in the overview.
Monitor the SendCommand API call related to the created SSM document to see if it is used to execute commands on managed instances, as described in the triage section.

AWS IAM Login Profile Added for Root

hello@craftedsignal.io — Fri, 10 Apr 2026 16:27:52 +0000

This rule detects the creation of a console login profile for the AWS account root user, a highly privileged account. While CreateLoginProfile is normally applied to IAM users, when executed from a temporary root session (e.g., via AssumeRoot) without specifying a userName, the profile is created for the root principal. This activity is especially concerning because it provides persistent access. An attacker gaining temporary root access via STS or credential compromise might exploit this to set a root password. The attacker can then use this new password to log in through the console. This method circumvents traditional access key rotation or disabling and can be employed even after the initial vulnerability is patched. This activity started being tracked on 2024-12-02, defenders need to be aware of this persistence mechanism and promptly investigate any such incidents.

Attack Chain

An attacker gains initial access to an AWS account with sufficient privileges, possibly through compromised credentials or an STS session.
The attacker executes the AssumeRoot API call to assume the privileges of the root user.
The attacker uses the CreateLoginProfile API call without specifying a userName. This action creates a console login profile directly for the root account instead of an IAM user. The aws.cloudtrail.request_parameters will not contain userName=.
The attacker sets a password for the root account using the CreateLoginProfile API. passwordResetRequired might be set to true or omitted, with omission potentially indicating an attacker-controlled password.
The attacker uses the newly created root account password to log in to the AWS Management Console. The event will be logged as a ConsoleLogin event.
The attacker uses the root account’s privileges to create or modify resources, escalate privileges, or exfiltrate data.
The attacker maintains persistence by using the console login, even if the initially compromised credentials or temporary session tokens are revoked.
The attacker may also create new IAM users or roles with elevated permissions to further solidify their presence.

Impact

A successful attack can lead to complete control over the AWS environment. The attacker can create, modify, or delete resources; access sensitive data; and disrupt services. Because the root user has unrestricted privileges, the impact is extremely high. There have been no reported victim counts. However, any successful exploitation can have severe impacts including data breaches, financial loss, and reputational damage.

Recommendation

Deploy the Sigma rule “AWS IAM Login Profile Added for Root” to detect unauthorized creation of login profiles for the root account and tune for your environment.
Investigate any CreateLoginProfile events where aws.cloudtrail.user_identity.type is Root and aws.cloudtrail.request_parameters does not contain userName=.
Enable CloudTrail, GuardDuty, AWS Config, and Security Hub across all regions for continuous monitoring of root and IAM activity to improve overall visibility.
Review IAM policies for least-privilege adherence, focusing on iam:CreateLoginProfile, iam:UpdateLoginProfile, and iam:CreateAccessKey permissions.

AWS EC2 LOLBin Execution via SSM SendCommand

hello@craftedsignal.io — Fri, 10 Apr 2026 16:27:52 +0000

This threat brief focuses on detecting the execution of Living Off the Land Binaries (LOLBins) or GTFOBins on Amazon EC2 instances via AWS Systems Manager (SSM) SendCommand API. The technique involves correlating AWS CloudTrail SendCommand events with endpoint process execution by matching SSM command IDs. While AWS redacts command parameters in CloudTrail logs, this correlation technique reveals the actual commands executed on EC2 instances. This is critical because adversaries may abuse SSM to execute malicious commands remotely without requiring SSH or RDP access. They can leverage legitimate system utilities for various malicious purposes, including data exfiltration, establishing reverse shells, or facilitating lateral movement within the cloud environment. The rule was last updated on 2026-04-10.

Attack Chain

An attacker gains initial access to AWS via compromised credentials or an exposed IAM role.
The attacker uses the AWS CLI or API to initiate an SSM SendCommand to a target EC2 instance. The DocumentName parameter is set to AWS-RunShellScript.
The SSM agent on the EC2 instance receives the SendCommand request.
The SSM agent executes a shell script (_script.sh) within a dedicated directory for orchestration.
The shell script executes a LOLBin, such as curl, wget, python, or perl, to perform malicious actions. The parent process of the LOLBin will be the SSM shell script.
The LOLBin is used to download a malicious payload, establish a reverse shell, or exfiltrate data.
The attacker uses the established reverse shell to perform further actions on the EC2 instance.

Impact

Successful exploitation can lead to unauthorized access to EC2 instances, data exfiltration, deployment of malware, and lateral movement within the AWS environment. Although a number of impacted organizations is not available, this attack is able to bypass traditional network security controls. Organizations in any sector utilizing AWS EC2 instances and SSM are potentially at risk. The lack of required SSH or RDP access makes this technique particularly stealthy.

Recommendation

Enable AWS CloudTrail logging to capture SendCommand events and monitor for AWS-RunShellScript in the request_parameters.
Deploy the Sigma rule “Detect AWS EC2 LOLBin Execution via SSM SendCommand” to your SIEM and tune for your environment.
Monitor endpoint process execution logs for the execution of LOLBins like curl, wget, python, perl, nc, etc., with parent processes related to SSM.
Implement strict IAM policies to restrict SSM SendCommand permissions to only authorized users and roles.
Review and audit existing SSM configurations to identify and remediate any overly permissive settings.

AWS Research and Engineering Studio OS Command Injection Vulnerability (CVE-2026-5707)

hello@craftedsignal.io — Mon, 06 Apr 2026 22:16:25 +0000

CVE-2026-5707 is an OS command injection vulnerability affecting AWS Research and Engineering Studio (RES) versions 2025.03 through 2025.12.01. The vulnerability resides in the virtual desktop session name handling, where user-supplied input is not properly sanitized before being used in an OS command. A remote, authenticated attacker can exploit this flaw by providing a specially crafted session name, leading to arbitrary command execution as root on the virtual desktop host. Successful exploitation allows the attacker to gain full control over the affected host, potentially compromising sensitive data and disrupting services. Users are advised to upgrade to RES version 2026.03 or apply the corresponding mitigation patch to their existing environment. The vulnerability was reported on April 6, 2026.

Attack Chain

The attacker authenticates to the AWS RES environment with valid credentials.
The attacker initiates a request to create a new virtual desktop session.
The attacker crafts a malicious session name containing OS command injection payload.
The malicious session name is passed to the vulnerable function in AWS RES without proper sanitization.
The vulnerable function executes an OS command, incorporating the unsanitized session name.
The injected command within the session name is executed with root privileges on the virtual desktop host.
The attacker gains arbitrary command execution, allowing them to install malware, create new users, or modify system configurations.
The attacker achieves complete control of the virtual desktop host.

Impact

Successful exploitation of CVE-2026-5707 allows a remote attacker to execute arbitrary commands with root privileges on the virtual desktop host. This can lead to a complete compromise of the system, potentially affecting all users and data within the AWS RES environment. The attacker can steal sensitive information, install persistent backdoors, or disrupt critical services. The exact number of potential victims is unknown, but any organization utilizing vulnerable versions of AWS RES is at risk.

Recommendation

Immediately upgrade AWS Research and Engineering Studio (RES) to version 2026.03 or apply the recommended mitigation patch to address CVE-2026-5707.
Implement input validation and sanitization for all user-supplied data, especially session names, to prevent OS command injection vulnerabilities.
Monitor AWS RES logs for suspicious activity related to session creation and command execution on the virtual desktop hosts.
Deploy the Sigma rule “Detect Suspicious Session Names with OS Command Injection Characters” to identify potential exploitation attempts.
Review and harden the security configurations of the virtual desktop hosts to limit the impact of potential command execution.

AWS Research and Engineering Studio (RES) RCE via FileBrowser API Vulnerability

hello@craftedsignal.io — Mon, 06 Apr 2026 22:16:25 +0000

CVE-2026-5709 affects AWS Research and Engineering Studio (RES), a cloud-based platform for research and engineering workflows. The vulnerability resides in the FileBrowser API and is present in versions 2024.10 through 2025.12.01. An authenticated attacker can exploit this vulnerability by sending crafted input to the FileBrowser functionality, leading to arbitrary command execution on the underlying cluster-manager EC2 instance. This could allow attackers to gain complete control over the RES environment, potentially compromising sensitive data and disrupting critical research activities. AWS recommends that users upgrade to RES version 2026.03 or apply a mitigation patch.

Attack Chain

An attacker gains valid credentials for an AWS Research and Engineering Studio (RES) account.
The attacker authenticates to the RES environment.
The attacker crafts malicious input designed to exploit the unsanitized input vulnerability in the FileBrowser API.
The attacker sends the crafted input to the FileBrowser API endpoint.
The FileBrowser API processes the input without proper sanitization.
The unsanitized input is executed as an operating system command on the cluster-manager EC2 instance.
The attacker achieves arbitrary command execution, potentially installing malware, exfiltrating data, or creating new administrative accounts.

Impact

Successful exploitation of CVE-2026-5709 grants the attacker the ability to execute arbitrary commands on the cluster-manager EC2 instance within the AWS Research and Engineering Studio (RES) environment. This can lead to complete compromise of the RES environment, data theft, denial of service, and potential lateral movement to other AWS resources. Due to the nature of research environments, this vulnerability could expose highly sensitive data, intellectual property, and research findings. The impact is significant due to the potential for widespread damage and disruption of critical research activities.

Recommendation

Immediately upgrade AWS Research and Engineering Studio (RES) to version 2026.03 or apply the recommended mitigation patch provided by AWS to remediate CVE-2026-5709.
Implement the Sigma rule “Detect Suspicious FileBrowser API Requests” to identify potential exploitation attempts targeting the FileBrowser API.
Monitor web server logs for suspicious activity related to the FileBrowser API endpoint, looking for unusual characters or command injection attempts.

AWS IAM Long-Term Access Key Correlated with Elevated Detection Alerts

hello@craftedsignal.io — Mon, 06 Apr 2026 14:37:37 +0000

This detection rule, published by Elastic, is designed to correlate AWS security alerts and prioritize investigations related to potentially compromised IAM access keys. Specifically, it focuses on scenarios where a long-term IAM access key is observed originating from a new source IP address (detected by the “AWS Long-Term Access Key First Seen from Source IP” rule, rule ID 9f8e3c5e-f72e-4e91-93f6-e98a4fae3e4f) and is also associated with other open alerts of medium, high, or critical severity. This correlation aims to surface instances where a newly exposed or compromised access key is actively being used for malicious activities, enabling security teams to respond more effectively to potential credential access incidents and initial access attempts. The rule is a higher-order rule that analyzes existing security alerts within an Elastic Security deployment and leverages the kibana.alert fields to identify related events.

Attack Chain

An attacker gains access to a valid AWS IAM Long-Term Access Key. This could be through phishing, credential stuffing, or exposed credentials in source code.
The attacker uses the compromised access key to interact with AWS services from a new and previously unseen IP address. This triggers the “AWS Long-Term Access Key First Seen from Source IP” rule (rule ID: 9f8e3c5e-f72e-4e91-93f6-e98a4fae3e4f).
The attacker leverages the compromised credentials to perform reconnaissance activities within the AWS environment, such as listing resources or querying IAM configurations.
The attacker attempts to escalate privileges by exploiting misconfigurations or vulnerabilities in IAM policies.
The attacker performs actions indicating lateral movement within the AWS environment, such as accessing or modifying resources in different AWS accounts.
The attacker compromises additional AWS resources or services, such as EC2 instances or S3 buckets. These activities trigger medium, high, or critical severity alerts.
The correlation rule identifies the co-occurrence of the “AWS Long-Term Access Key First Seen from Source IP” alert and other elevated severity alerts associated with the same access key ID.
The security team investigates the correlated alerts and takes appropriate remediation steps, such as rotating the compromised access key and reviewing IAM policies.

Impact

A successful attack leveraging compromised AWS IAM credentials can lead to significant data breaches, service disruption, and financial losses. Attackers can gain unauthorized access to sensitive data stored in S3 buckets, compromise EC2 instances, and disrupt critical AWS services. The correlation rule aims to reduce the dwell time of attackers by prioritizing the investigation of compromised credentials associated with ongoing malicious activity. This can prevent attackers from further escalating their attacks and minimizing the overall impact of the breach. Failure to detect and respond to these attacks can result in regulatory fines, reputational damage, and loss of customer trust.

Recommendation

Deploy the “AWS IAM Long-Term Access Key Correlated with Elevated Detection Alerts” rule (rule ID 98cfaa44-83f0-4aba-90c4-363fb9d51a75) in your Elastic Security environment to identify potentially compromised IAM access keys.
Investigate alerts triggered by the rule by pivoting on the aws.cloudtrail.user_identity.access_key_id in CloudTrail and IAM to understand the context of the access key usage.
Review the sibling alerts identified by the rule using Esql.kibana_alert_rule_name_values and Esql.kibana_alert_rule_id_values to understand the scope and impact of the potential compromise.
Configure your Elastic Security deployment to properly map risk scores to severity levels, ensuring that kibana.alert.risk_score >= 47 corresponds to medium or higher severity alerts.
Rotate or disable any IAM access keys identified as compromised by the rule to prevent further unauthorized access.
Enable AWS CloudTrail logging to capture detailed information about API calls made within your AWS environment, providing valuable context for investigating security alerts.
Implement the “AWS Long-Term Access Key First Seen from Source IP” rule (rule_id: 9f8e3c5e-f72e-4e91-93f6-e98a4fae3e4f) if not already enabled, as it is a pre-requisite for this correlation rule.

AWS SDK for PHP CloudFront Policy Document Injection via Special Characters

hello@craftedsignal.io — Fri, 27 Mar 2026 19:54:58 +0000

A vulnerability exists in the CloudFront signing utilities within the AWS SDK for PHP, specifically impacting versions 3.11.7 through 3.371.3. These utilities are responsible for generating Amazon CloudFront signed URLs and signed cookies, which control access to content. The vulnerability arises from the improper handling of special characters, such as double quotes and backslashes, within input values used to construct policy documents. If an application passes unsanitized input containing these characters to the signing utilities, the resulting policy document may deviate from the application’s intended access restrictions. An enhancement was made to the AWS SDK for PHP version 3.371.4 to address this issue. This vulnerability impacts applications that do not properly sanitize inputs passed to the CloudFront signing utilities.

Attack Chain

An attacker identifies an application using a vulnerable version of the AWS SDK for PHP (3.11.7 - 3.371.3) that utilizes CloudFront signed URLs or cookies.
The attacker locates an input field within the application that is used to generate CloudFront policy documents.
The attacker crafts a malicious input string containing special characters (e.g., double quotes, backslashes) designed to manipulate the resulting policy document.
The application passes the attacker-controlled input to the CloudFront signing utilities without proper sanitization or validation.
The CloudFront signing utilities generate a signed URL or cookie with a flawed policy document due to the injected special characters.
The attacker uses the crafted signed URL or cookie to bypass intended access restrictions and potentially gain unauthorized access to protected content.
The attacker accesses restricted resources on CloudFront that should have been protected by the intended policy.

Impact

Successful exploitation of this vulnerability could lead to unauthorized access to content protected by Amazon CloudFront. If an attacker can manipulate the policy document, they might bypass intended access restrictions, potentially exposing sensitive data or allowing unauthorized actions. The number of affected applications is unknown, but any application using the vulnerable versions of the AWS SDK for PHP and failing to sanitize input is at risk.

Recommendation

Upgrade to AWS SDK for PHP version 3.371.4 or later to incorporate the fix that addresses special character handling (reference: Patches section).
Implement robust input validation in application code to sanitize or escape special characters before passing values to CloudFront signing utilities (reference: Workarounds section).
Monitor web server logs for unusual patterns of URL requests containing special characters that might indicate exploitation attempts (reference: webserver log source).

AWS STS Role Assumption by User

hello@craftedsignal.io — Wed, 04 Mar 2026 18:01:49 +0000

This detection rule identifies when an IAM user assumes a role in AWS Security Token Service (STS) within an AWS environment. The AWS Security Token Service (STS) allows users to request temporary, limited-privilege credentials for accessing AWS resources. While legitimate role assumption is common for authorized access, adversaries can abuse this mechanism to escalate privileges or move laterally within a compromised AWS account. This behavior is detected by monitoring AWS CloudTrail logs for AssumeRole events from IAM users. The rule focuses on identifying potentially malicious role assumptions by correlating the user identity, assumed role, and source information.

Attack Chain

An attacker gains initial access to an AWS account as an IAM user, potentially through compromised credentials or an exposed access key.
The attacker enumerates available IAM roles within the AWS environment to identify roles with elevated privileges or access to sensitive resources.
The attacker calls the AssumeRole API in AWS STS, requesting temporary credentials for the target role, using a roleSessionName for context.
The STS service validates the request and, if authorized, issues temporary credentials consisting of an accessKeyId, secretAccessKey, and sessionToken.
The attacker configures their AWS CLI or SDK with the temporary credentials obtained from the STS service.
The attacker uses the temporary credentials to access AWS resources and perform actions permitted by the assumed role, such as modifying security groups, accessing S3 buckets, or launching EC2 instances.
The attacker may attempt to further escalate privileges by assuming additional roles or creating new IAM users with administrative privileges.

Impact

A successful role assumption can grant an attacker access to sensitive data, allow them to disrupt critical services, or provide a foothold for further attacks within the AWS environment. While this rule has a low severity, a high volume of alerts should be reviewed as it could indicate ongoing lateral movement and privilege escalation. The impact of a successful attack can range from data breaches and service disruptions to complete compromise of the AWS environment.

Recommendation

Deploy the Sigma rule provided below to your SIEM and tune for your environment to detect suspicious role assumptions.
Investigate any alerts generated by the rule by reviewing the associated CloudTrail logs, specifically the aws.cloudtrail.user_identity.arn and aws.cloudtrail.resources.arn fields.
Implement additional monitoring for high-risk roles with elevated permissions, and create exceptions for trusted patterns.
Regularly review IAM policies and roles to minimize the risk of privilege escalation.
Refer to the AWS STS documentation for more details on managing and securing AWS STS in your environment.

Suspicious AWS EC2 Key Pair Import Activity

hello@craftedsignal.io — Thu, 19 Dec 2024 00:00:00 +0000

The unauthorized import of SSH key pairs into Amazon Elastic Compute Cloud (EC2) is a technique that malicious actors can leverage to gain unauthorized access to EC2 instances. By importing their own key pairs, attackers can bypass existing security measures and gain persistent access to compromised systems. This activity is often part of a broader attack campaign aimed at compromising sensitive data, disrupting services, or establishing a foothold within an organization’s cloud infrastructure. The initial publication of the detection rule was in December 2024, highlighting the ongoing relevance of this technique in cloud security. Monitoring for this activity can help defenders identify and respond to potential security breaches in a timely manner.

Attack Chain

An attacker gains initial access to an AWS account, potentially through compromised credentials or exploiting a misconfigured IAM role.
The attacker attempts to enumerate existing EC2 instances to identify potential targets.
The attacker generates or obtains an SSH key pair, which they intend to use for unauthorized access.
The attacker uses the ImportKeyPair API call within the EC2 service to import the generated or obtained SSH key pair.
The attacker modifies the EC2 instance’s configuration to associate the newly imported key pair with the instance. This might involve stopping and restarting the instance.
The attacker uses the imported SSH key pair to gain SSH access to the EC2 instance.
Once inside the instance, the attacker attempts to escalate privileges and move laterally within the AWS environment.
The attacker exfiltrates sensitive data, deploys malware, or disrupts critical services.

Impact

A successful key pair import can lead to complete compromise of the affected EC2 instances, potentially impacting dozens of servers depending on the environment. Sensitive data stored on or accessible from these instances could be exfiltrated, leading to financial loss, reputational damage, and regulatory fines. Furthermore, compromised instances can be used as a launchpad for further attacks within the AWS environment, leading to a wider breach. The financial impact can range from tens of thousands to millions of dollars, depending on the scale of the breach and the sensitivity of the data compromised.

Recommendation

Deploy the provided Sigma rule to your SIEM to detect ImportKeyPair events in CloudTrail logs (logsource: aws, service: cloudtrail).
Review IAM policies to ensure that only authorized users and roles have the necessary permissions to import key pairs (eventSource: ’ec2.amazonaws.com’, eventName: ‘ImportKeyPair’).
Investigate any detected ImportKeyPair events, validating the user identity, user agent, and source IP address to ensure they are expected (detection block).
Implement multi-factor authentication (MFA) for all AWS accounts to reduce the risk of credential compromise.

AWS SAML Provider Deletion Activity

hello@craftedsignal.io — Thu, 19 Dec 2024 00:00:00 +0000

The deletion of a SAML provider in AWS can be a significant indicator of malicious activity. An attacker who has gained initial access to an AWS environment may attempt to remove the SAML provider used by the information security team or system administrators. This action can severely impede the team’s ability to investigate and respond to ongoing attacks. By disrupting access, the attacker gains a window of opportunity to further escalate privileges, move laterally within the environment, and achieve their objectives without immediate detection or intervention. This activity directly impacts the availability and integrity of resources within the AWS cloud environment.

Attack Chain

Initial access is gained to an AWS account through compromised credentials or other means (T1078.004).
The attacker enumerates existing IAM resources, including SAML providers, using AWS CLI or API calls.
The attacker identifies the SAML provider used by administrative or security teams.
The attacker executes the DeleteSAMLProvider API call via the AWS CLI, API, or AWS Management Console (T1531).
The DeleteSAMLProvider event is logged in AWS CloudTrail with a “success” status.
Administrative and security teams lose access to AWS resources that require SAML authentication.
The attacker leverages the compromised account to escalate privileges, create new IAM users, or modify existing policies.
The attacker persists in the environment, potentially exfiltrating data or deploying malicious workloads (T1485).

Impact

The deletion of an AWS SAML provider can have serious consequences. It disrupts access for administrators and security personnel, delaying incident response and potentially allowing attackers to further compromise the environment. This can lead to data breaches, service disruptions, and financial losses. The severity of the impact depends on the criticality of the affected AWS resources and the speed of detection and recovery.

Recommendation

Deploy the Sigma rule “AWS SAML Provider Deletion Activity” to your SIEM and tune for your environment to detect this specific event.
Investigate any DeleteSAMLProvider events in AWS CloudTrail, focusing on the user identity, user agent, and source IP address (logsource: aws/cloudtrail).
Implement multi-factor authentication (MFA) for all IAM users, especially those with administrative privileges, to reduce the risk of credential compromise (T1110).
Review and enforce the principle of least privilege for all IAM roles and users to limit the impact of compromised credentials.

Detect AWS Route Table Modification via CloudTrail

hello@craftedsignal.io — Fri, 01 Nov 2024 12:00:00 +0000

The addition of a new route to an AWS route table can be a sign of malicious activity, especially if the route redirects traffic to an unexpected or unauthorized destination. This activity is typically logged in AWS CloudTrail. Attackers might add routes to intercept network traffic, conduct man-in-the-middle attacks, or impair defenses by routing traffic away from security appliances. Understanding who is performing this action and the destination of the new route is critical for identifying potential threats within an AWS environment.

Attack Chain

An attacker gains unauthorized access to an AWS account, potentially through compromised credentials or an exploited vulnerability.
The attacker uses the AWS CLI or the AWS Management Console to interact with the EC2 service.
The attacker identifies the target route table to modify.
The attacker executes the CreateRoute API call, specifying the destination CIDR block and target (e.g., an internet gateway, virtual private gateway, or network interface).
CloudTrail logs the CreateRoute event, capturing details of the action, including the user identity, source IP address, and the route table modification.
Network traffic matching the new route’s destination CIDR block is now redirected to the attacker-controlled target.
The attacker monitors and potentially modifies the redirected traffic for reconnaissance or data exfiltration purposes.

Impact

Successful modification of AWS route tables can lead to significant security breaches. An attacker could redirect critical network traffic to a malicious endpoint, enabling them to intercept sensitive data or disrupt services. This could lead to data breaches, financial loss, and reputational damage. The scope of the impact depends on the criticality of the redirected traffic and the attacker’s objectives.

Recommendation

Deploy the “Detect AWS Route Table Modification via CloudTrail” Sigma rule to your SIEM and tune for your environment to detect suspicious route creation events in AWS CloudTrail logs.
Investigate any CreateRoute events where the user identity is unexpected or the destination CIDR block and target are suspicious.
Monitor AWS CloudTrail logs for CreateRoute events and correlate them with other suspicious activities.
Implement strict IAM policies to limit who can modify route tables (reference the eventSource and eventName fields in the rule below).

Potential Abuse of AWS Console GetSigninToken

hello@craftedsignal.io — Mon, 29 Apr 2024 12:00:00 +0000

The AWS GetSigninToken API, typically used for legitimate console access, can be abused by attackers to generate temporary, federated credentials. This technique, often facilitated by tools like aws_consoler, allows attackers to obfuscate the compromised access keys used to generate the tokens. By pivoting from the AWS CLI to console sessions with these temporary credentials, adversaries bypass MFA requirements and complicate forensic investigations. This activity is crucial for defenders to monitor, especially in environments not configured for AWS SSO, as it can indicate unauthorized access and lateral movement within the AWS infrastructure. The tool aws_consoler is specifically designed to automate this process, creating a streamlined path for malicious actors to leverage compromised credentials for further exploitation.

Attack Chain

An attacker gains initial access to AWS environment using compromised credentials (access key, secret key).
The attacker uses the compromised credentials with the AWS CLI or SDK to call the GetSigninToken API.
AWS CloudTrail logs the GetSigninToken event with the event source signin.amazonaws.com and event name GetSigninToken.
The GetSigninToken API returns a temporary sign-in token.
The attacker uses the temporary token along with the AWS account ID to construct a sign-in URL.
The attacker accesses the AWS Management Console via the crafted URL, bypassing MFA if the original compromised credentials required it.
Once in the console, the attacker performs reconnaissance, identifies valuable resources, and escalates privileges as needed.
The attacker moves laterally within the AWS environment, accessing and potentially exfiltrating sensitive data, or disrupting services.

Impact

Successful abuse of the GetSigninToken API can lead to unauthorized access to the AWS Management Console, enabling lateral movement and data exfiltration. The obfuscation of the original compromised credentials makes incident response more difficult. While the exact number of victims is unknown, this technique has been observed in intrusions targeting telecom and BPO companies. The impact includes potential data breaches, service disruptions, and reputational damage.

Recommendation

Deploy the provided Sigma rule to your SIEM to detect suspicious GetSigninToken events in AWS CloudTrail logs.
Investigate any GetSigninToken events originating from outside of expected AWS SSO user agents or other known legitimate sources.
Monitor AWS CloudTrail logs for GetSigninToken events where the requesting user identity does not match expected patterns.
Implement and enforce MFA for all AWS IAM users, even though this attack bypasses it for console access using the temporary tokens.
Review and restrict IAM policies to adhere to the principle of least privilege, minimizing the potential impact of compromised credentials.

AWS Identity API Access from Rare ASN Organizations

hello@craftedsignal.io — Mon, 29 Jan 2024 12:00:00 +0000

This detection identifies AWS identities that primarily use API traffic originating from well-known cloud providers (e.g., Amazon, Google, Microsoft), but also exhibit a small amount of traffic from less common Autonomous System (AS) organizations. This pattern can indicate that automation or CI credentials are being reused or pivoted outside of their usual hosted cloud environment. The detection focuses on successful API calls and looks for a combination of high volume from trusted cloud providers and at least one sensitive action originating from an uncommon network. This behavior could be indicative of credential compromise and lateral movement. This rule was published by Elastic on 2026-04-22.

Attack Chain

An attacker gains access to valid AWS credentials, potentially through phishing, credential stuffing, or exposed secrets.
The attacker uses the compromised credentials to make API calls from their own infrastructure, which is associated with a rare AS organization.
The attacker performs reconnaissance, such as GetCallerIdentity, ListBuckets, or ListSecrets, to understand the AWS environment.
The attacker attempts to escalate privileges by calling AssumeRole, AttachUserPolicy, or CreateAccessKey.
The attacker attempts to access sensitive data using actions such as GetObject or GetSecretValue.
The attacker attempts to create new users or modify existing user profiles using actions such as CreateUser, UpdateLoginProfile, or AddUserToGroup.
The attacker may attempt to invoke cloud ML models using InvokeModel or Converse to further their objectives.
The attacker persists in the environment by creating new IAM users, roles, or policies, or by modifying existing ones.

Impact

A successful attack can lead to unauthorized access to sensitive data stored in S3 buckets, Secrets Manager, or other AWS services. It can also allow the attacker to escalate privileges, create new users, and modify existing configurations, leading to long-term control of the AWS environment. The severity of the impact depends on the level of access granted to the compromised credentials. This can lead to exfiltration of sensitive data, denial of service, or complete compromise of the AWS account.

Recommendation

Enable AWS CloudTrail logging in all regions and send logs to a centralized SIEM or logging platform to enable detection capabilities (references).
Deploy the Sigma rule “AWS Rare Source AS Organization Activity” translated from the provided ESQL query to detect unusual source ASNs for AWS API calls.
Investigate alerts generated by the rule, focusing on the user.name, aws.cloudtrail.user_identity.type, Esql.src_asn_values, and Esql.untrusted_suspicious_actions to understand the context of the activity.
Rotate credentials for the affected principal if abuse is suspected and enforce OIDC or short-lived keys for automation.
Tighten IAM and data-plane permissions to limit the impact of compromised credentials.

S3Browser IAM Policy Creation with Default Bucket Name

hello@craftedsignal.io — Fri, 26 Jan 2024 12:00:00 +0000

The S3Browser utility is being used to create Inline IAM policies within AWS. This activity is flagged as suspicious when the policy includes the default S3 bucket name placeholder value of . This could indicate that the user has not properly configured the policy or is unaware of the implications of using a generic placeholder, potentially granting unintended access to S3 resources. This behavior was observed being used by the threat actor Guivil. The use of S3Browser in this manner poses a risk of privilege escalation, persistence, and unauthorized access to sensitive data stored in S3 buckets.

Attack Chain

An attacker gains initial access to an AWS account, possibly through compromised credentials or misconfigured IAM roles (T1078.004).
The attacker utilizes the S3Browser utility to interact with AWS S3 buckets.
The attacker attempts to create an Inline IAM policy using S3Browser.
The attacker fails to replace the default bucket name placeholder with a specific bucket ARN.
The attacker saves the IAM policy with the default bucket name placeholder, leading to a broad or unintended scope of permissions.
The poorly configured policy is applied to a user, role, or group.
The attacker potentially escalates privileges or gains unauthorized access to S3 resources.
The attacker persists in the environment with the newly created or modified IAM policy.

Impact

Creation of an IAM policy with the default bucket name placeholder leaves S3 buckets open to potential unauthorized access. A successful attack could lead to data exfiltration, data modification, or denial of service. The scope of the impact depends on the specific permissions granted within the policy and the resources accessible through the affected IAM user, role, or group.

Recommendation

Deploy the Sigma rule “AWS IAM S3Browser Templated S3 Bucket Policy Creation” to your SIEM and tune for your environment to detect this specific activity.
Investigate any instances where PutUserPolicy events are associated with the S3Browser user agent (logsource: aws/cloudtrail).
Review existing IAM policies for the presence of the default bucket name placeholder arn:aws:s3:::/* (logsource: aws/cloudtrail).

AWS KMS Key Policy Updated via PutKeyPolicy

hello@craftedsignal.io — Mon, 22 Jan 2024 18:23:00 +0000

This rule detects the successful execution of the PutKeyPolicy API call within Amazon Web Services Key Management Service (AWS KMS). The PutKeyPolicy action replaces the entire key policy associated with a KMS key, potentially granting new or expanded permissions to principals. An adversary who gains the ability to modify KMS key policies (kms:PutKeyPolicy) can escalate privileges by adding external accounts or roles, allowing them to decrypt data protected by the key or maintain persistent access even after credential rotation. This activity is crucial to monitor, as it can lead to significant data breaches and unauthorized access to sensitive information. The rule focuses on identifying deviations from expected KMS key policy management practices to detect potentially malicious activity.

Attack Chain

An attacker compromises an AWS account or obtains IAM credentials with sufficient permissions, including kms:PutKeyPolicy on a target KMS key.
The attacker uses the compromised credentials to call the PutKeyPolicy API, replacing the existing key policy with a modified version.
The modified key policy grants the attacker’s AWS account, or an external account, permissions to perform cryptographic operations on the key, such as kms:Decrypt or kms:GenerateDataKey.
The attacker utilizes the newly granted permissions to decrypt data encrypted with the KMS key, such as data stored in S3 buckets or EBS volumes.
The attacker may also grant administrative actions to new identities.
The attacker exfiltrates the decrypted data to an external location.
The attacker attempts to cover their tracks by deleting CloudTrail logs or modifying other security configurations.

Impact

Successful exploitation can lead to unauthorized access to sensitive data encrypted with the KMS key, potentially resulting in data breaches, financial loss, and reputational damage. The severity depends on the sensitivity of the data protected by the key and the scope of access granted to the attacker. This can impact organizations across various sectors that rely on AWS KMS for data encryption, potentially affecting millions of records and causing significant operational disruption.

Recommendation

Deploy the Sigma rule “AWS KMS Key Policy Updated via PutKeyPolicy” to your SIEM and tune for your environment to detect unauthorized modifications to KMS key policies.
Review the policy document diff in aws.cloudtrail.request_parameters and aws.cloudtrail.response_elements to identify unauthorized changes to principals.
Restrict the kms:PutKeyPolicy permission to break-glass roles only, limiting the potential for unauthorized modifications.
Monitor iam:AttachRolePolicy and sts:AssumeRole events to correlate with potential privilege escalation attempts related to KMS key access.
Restore a known-good KMS policy from backup or IAM/KMS change history to remediate unauthorized modifications.

Successful AWS Console Login Without MFA

hello@craftedsignal.io — Tue, 09 Jan 2024 15:00:00 +0000

The absence of multi-factor authentication (MFA) during AWS console logins presents a significant security risk. Threat actors often target AWS environments due to the high value of data and services hosted within. An attacker gaining initial access through compromised credentials can move laterally, escalate privileges, and potentially exfiltrate sensitive data, deploy malicious workloads, or disrupt critical services. This activity can go unnoticed for extended periods, increasing the potential for damage. Detecting successful console logins without MFA is crucial for identifying potential breaches and ensuring the enforcement of security best practices. This brief focuses on detecting these logins to mitigate the risk of unauthorized access and potential data breaches.

Attack Chain

An attacker obtains valid AWS credentials, possibly through phishing, credential stuffing, or by exploiting a vulnerable service.
The attacker uses the compromised credentials to attempt to log in to the AWS Management Console.
The attacker successfully authenticates without providing an MFA code, indicating MFA is not enabled or is bypassed for the compromised user.
After successful login, the attacker enumerates existing AWS resources, including EC2 instances, S3 buckets, and IAM roles, using the AWS CLI or Console.
The attacker attempts to escalate privileges by exploiting IAM misconfigurations or vulnerabilities to gain access to more sensitive resources.
The attacker modifies security configurations, such as disabling CloudTrail logging or creating new IAM users with elevated permissions, to establish persistence.
The attacker accesses sensitive data stored in S3 buckets or databases, potentially exfiltrating it to an external location.

Impact

A successful AWS console login without MFA can lead to a full compromise of the AWS environment. Attackers can gain unauthorized access to sensitive data, disrupt critical services, and deploy malicious workloads. The lack of MFA increases the likelihood of successful credential-based attacks, potentially affecting a large number of organizations hosting data and applications in AWS. Consequences include data breaches, financial losses, reputational damage, and legal liabilities.

Recommendation

Deploy the “AWS Successful Console Login Without MFA” Sigma rule to your SIEM to detect logins without MFA (rule).
Enforce MFA for all AWS IAM users, especially those with administrative privileges to prevent initial access (reference: https://securitylabs.datadoghq.com/cloud-security-atlas/vulnerabilities/iam-user-without-mfa/).
Regularly audit IAM configurations to identify and remediate misconfigurations that could allow privilege escalation.
Monitor CloudTrail logs for suspicious activity following a console login, such as resource enumeration or IAM policy changes (logsource).

Suspicious AWS SAML Activity Detection

hello@craftedsignal.io — Wed, 03 Jan 2024 18:22:30 +0000

This detection identifies potentially malicious Security Assertion Markup Language (SAML) activity within Amazon Web Services (AWS). The activity includes monitoring for AssumeRoleWithSAML and UpdateSAMLProvider events. An adversary might exploit SAML to gain unauthorized access, escalate privileges, move laterally within the AWS environment, or establish persistent backdoor access. The focus is on detecting unusual or unauthorized modifications to SAML configurations and role assumptions, which could indicate a compromised identity provider or malicious actor leveraging SAML for illicit purposes. Defenders should prioritize monitoring SAML-related API calls to identify and mitigate potential threats early in the attack chain.

Attack Chain

The attacker compromises or creates a malicious SAML identity provider.
The attacker configures the AWS environment to trust the malicious SAML provider using UpdateSAMLProvider.
The attacker crafts a SAML assertion to assume a specific role within the AWS environment.
The attacker uses the AssumeRoleWithSAML API call to authenticate with AWS using the crafted SAML assertion.
AWS STS validates the SAML assertion and, if valid, provides temporary credentials for the assumed role.
The attacker uses the temporary credentials to perform actions within AWS, potentially escalating privileges.
The attacker moves laterally within the AWS environment, accessing resources and services authorized for the assumed role.
The attacker establishes persistent access by creating backdoors or modifying existing IAM policies, leveraging the initially gained access.

Impact

Successful exploitation via SAML manipulation can lead to a complete compromise of the AWS environment. Attackers can gain unauthorized access to sensitive data, disrupt critical services, and deploy malicious infrastructure. The impact includes potential data breaches, financial losses, and reputational damage. The number of affected resources depends on the permissions associated with the roles assumed by the attacker.

Recommendation

Deploy the Sigma rule for AssumeRoleWithSAML events to detect suspicious role assumptions (see “AssumeRoleWithSAML Detection Rule”).
Deploy the Sigma rule for UpdateSAMLProvider events to detect unauthorized SAML provider modifications (see “UpdateSAMLProvider Detection Rule”).
Investigate any AssumeRoleWithSAML events originating from unfamiliar user agents or IP addresses by reviewing CloudTrail logs.
Monitor UpdateSAMLProvider events for unexpected changes to SAML provider configurations. Review associated CloudTrail logs for user identity, user agent, and hostname to ensure authorized access.
Tune the provided Sigma rules for your environment, addressing false positives by exempting known, legitimate behavior.

AWS GuardDuty Detector Deletion or Disablement

hello@craftedsignal.io — Wed, 03 Jan 2024 17:38:00 +0000

Attackers with sufficient AWS privileges may attempt to disable or delete AWS GuardDuty detectors to evade detection. GuardDuty is a threat detection service that monitors AWS accounts for malicious activity. Disabling it allows attackers to operate with less chance of being detected. This activity may occur post-compromise as part of a broader defense evasion strategy, or as a precursor to malicious activities. The deletion or disabling of GuardDuty detectors should be considered a critical event, warranting immediate investigation to verify legitimacy. The references suggest that this behavior has been observed in the wild and is documented across multiple security vendors.

Attack Chain

An attacker gains initial access to an AWS account through compromised credentials or other means (T1078).
The attacker enumerates existing GuardDuty detectors to identify the target for disabling or deletion (T1068).
The attacker authenticates to the AWS API using stolen credentials or an assumed role with sufficient permissions.
The attacker calls the DeleteDetector API to remove the GuardDuty detector entirely, erasing all existing findings (T1685.002).
Alternatively, the attacker calls the UpdateDetector API to disable the detector by setting the enable parameter to false (T1685.002).
AWS CloudTrail logs the DeleteDetector or UpdateDetector event with a Success or null error code.
With GuardDuty disabled, the attacker performs malicious actions such as lateral movement, data exfiltration, or resource compromise without immediate detection.
The attacker attempts to remove CloudTrail logs to further impair defenses (T1562.008).

Impact

A successful attack can lead to the complete loss of threat detection capabilities within the AWS environment. With GuardDuty disabled, malicious activities can go unnoticed, potentially leading to data breaches, unauthorized access, or resource compromise. The impact is significant because GuardDuty is a primary security control for many organizations using AWS. Depending on the attacker’s objectives, this could result in financial loss, reputational damage, or compliance violations. The references suggest that this is a known technique used by attackers to evade detection in AWS environments.

Recommendation

Deploy the Sigma rule “AWS GuardDuty Detector Deleted Or Updated” to your SIEM using AWS CloudTrail logs to detect attempts to disable or delete GuardDuty (logsource: aws, service: cloudtrail).
Investigate all instances of DeleteDetector and UpdateDetector events in CloudTrail, especially if initiated from unusual locations or IAM roles.
Implement multi-factor authentication (MFA) for all IAM users to reduce the risk of credential compromise (T1110).
Enforce the principle of least privilege by granting only necessary permissions to IAM roles (T1078).
Monitor CloudTrail logs for anomalies that could indicate malicious activity following a GuardDuty disablement.

AWS Lateral Movement from Kubernetes Service Account via AssumeRoleWithWebIdentity

hello@craftedsignal.io — Wed, 03 Jan 2024 15:00:00 +0000

This detection rule identifies lateral movement in AWS environments stemming from Kubernetes service accounts utilizing AssumeRoleWithWebIdentity. It focuses on detecting instances where credentials obtained via this method are subsequently used to perform several distinct AWS control-plane actions within a single session. This behavior deviates from typical pod traffic and could signify unauthorized access or privilege escalation. The rule prioritizes the detection of sensitive API usage, including reconnaissance activities, access to secrets, IAM modifications, and compute creation events, while strategically excluding high-volume S3 data-plane operations to minimize false positives. The targeted environments are those leveraging EKS IAM Roles for Service Accounts.

Attack Chain

A Kubernetes service account projects a token.
The service account uses AssumeRoleWithWebIdentity to exchange the token for short-lived IAM credentials.
The attacker leverages the assumed role to perform reconnaissance activities such as ListUsers, ListRoles, and DescribeInstances.
The attacker attempts to access secrets using actions like GetSecretValue and ListSecrets.
The attacker escalates privileges by modifying IAM policies with actions like AttachRolePolicy and PutRolePolicy.
The attacker attempts to create new users or roles within the AWS environment using actions like CreateUser and CreateRole.
The attacker performs lateral movement using actions like SendCommand and StartSession.
The attacker attempts to evade detection by stopping logging with the StopLogging action.

Impact

Successful exploitation can lead to unauthorized access to sensitive data, privilege escalation, and the potential compromise of the entire AWS environment. Lateral movement within the AWS infrastructure allows attackers to gain access to critical systems and data, potentially leading to data breaches, service disruptions, or other malicious activities.

Recommendation

Deploy the provided Sigma rule to your SIEM to detect potentially malicious activity related to AssumeRoleWithWebIdentity and tune for your environment.
Review and harden IAM role trust policies associated with Kubernetes service accounts, specifically focusing on OIDC trust conditions, as referenced in the IAM OIDC identity provider documentation.
Implement strict least privilege principles for Kubernetes service accounts, limiting their access to only the necessary AWS resources, as covered in EKS IAM roles for service accounts.
Monitor CloudTrail logs for AssumeRoleWithWebIdentity events followed by suspicious API calls, focusing on the actions listed in the Sigma rule detection patterns.

AWS SecurityHub Findings Evasion via API Calls

hello@craftedsignal.io — Wed, 03 Jan 2024 14:30:00 +0000

Attackers with sufficient AWS privileges can manipulate SecurityHub findings to evade detection and maintain persistence within a compromised environment. This involves using SecurityHub’s API to either modify existing findings, delete insights altogether, or update insights to mask malicious activity. This activity is conducted via API calls to securityhub.amazonaws.com, specifically targeting the BatchUpdateFindings, DeleteInsight, UpdateFindings, and UpdateInsight actions. Successful evasion allows malicious actors to operate without triggering alarms or attracting attention from security personnel, leading to prolonged compromise and potentially greater damage. This is especially critical in production environments where SecurityHub findings are actively monitored.

Attack Chain

The attacker gains initial access to an AWS account, potentially through compromised credentials or exploiting a misconfigured IAM role (T1078).
The attacker enumerates existing SecurityHub findings and insights to identify potential targets for modification or deletion.
The attacker calls the BatchUpdateFindings API to modify the severity, confidence, or resolution status of specific findings, effectively silencing alerts (T1562.003).
Alternatively, the attacker calls the UpdateFindings API to modify individual findings.
The attacker calls the DeleteInsight API to remove custom insights that could reveal their activities (T1562).
As another option, the attacker calls the UpdateInsight API to modify the criteria of existing insights, causing them to miss malicious activities.
The attacker validates the changes by querying SecurityHub to confirm that the targeted findings and insights have been successfully altered or removed.
The attacker continues malicious activities, such as data exfiltration or lateral movement, with a reduced risk of detection due to the modified SecurityHub state (TA0005).

Impact

Successful evasion of SecurityHub findings can lead to delayed incident response, prolonged attacker presence within the AWS environment, and increased data exfiltration or system compromise. The impact is particularly severe in production environments where SecurityHub is relied upon for real-time threat detection and alerting. By modifying or deleting findings, attackers can effectively blind security teams, enabling them to operate undetected for extended periods. The number of potential victims is directly proportional to the scale of AWS deployments relying on SecurityHub.

Recommendation

Deploy the Sigma rule “AWS SecurityHub Findings Evasion” to your SIEM and tune for your environment to detect suspicious API calls related to findings manipulation (logsource: aws, service: cloudtrail).
Review and harden IAM policies to restrict access to SecurityHub API actions such as BatchUpdateFindings, DeleteInsight, UpdateFindings, and UpdateInsight to only authorized users and roles.
Implement multi-factor authentication (MFA) for all AWS accounts and roles, especially those with permissions to modify SecurityHub configurations.
Regularly audit CloudTrail logs for suspicious activity related to SecurityHub configuration changes.

AWS Identity Center Identity Provider Modification

hello@craftedsignal.io — Wed, 03 Jan 2024 14:30:00 +0000

AWS Identity Center (formerly AWS SSO) enables centralized management of access to AWS accounts and applications. Attackers can manipulate the configured identity provider to gain unauthorized access. The modification of the configured Identity Provider (IdP) within AWS Identity Center can lead to a full compromise of the AWS environment. By associating a malicious directory or disabling/disassociating legitimate directories, attackers can potentially establish persistent access, escalate privileges, and impersonate legitimate users. This can be achieved by utilizing compromised AWS credentials or exploiting vulnerabilities in the AWS environment.

Attack Chain

Initial access is gained via compromised AWS credentials or by exploiting an AWS vulnerability.
The attacker enumerates the current AWS Identity Center configuration to identify the currently associated directory.
The attacker disassociates the existing, legitimate directory using DisassociateDirectory.
The attacker associates a malicious directory they control using AssociateDirectory. This malicious directory is configured to impersonate legitimate users.
Alternatively, the attacker disables external IdP configuration for the directory using DisableExternalIdPConfigurationForDirectory.
The attacker enables external IdP configuration for the directory, pointing to an attacker-controlled IdP, using EnableExternalIdPConfigurationForDirectory.
The attacker uses the malicious or attacker-controlled IdP to authenticate as legitimate users, gaining access to AWS resources.
The attacker performs malicious actions within the AWS environment, such as data exfiltration or resource destruction.

Impact

Successful modification of the AWS Identity Center identity provider can lead to complete compromise of an AWS environment. Attackers can gain persistent access, escalate privileges, and impersonate legitimate users. This can result in data breaches, service disruption, financial loss, and reputational damage. The impact can extend to all AWS accounts and applications managed by the compromised Identity Center instance.

Recommendation

Deploy the provided Sigma rule to your SIEM to detect unauthorized changes to the AWS Identity Center identity provider.
Investigate any detected events related to AssociateDirectory, DisableExternalIdPConfigurationForDirectory, DisassociateDirectory, or EnableExternalIdPConfigurationForDirectory in AWS CloudTrail logs.
Implement multi-factor authentication (MFA) for all AWS accounts and users to reduce the risk of credential compromise.
Review and restrict IAM permissions to minimize the blast radius of compromised credentials.
Monitor AWS CloudTrail logs for unusual activity patterns that might indicate malicious directory association attempts.

AWS IAM User or Access Key Creation via S3 Browser

hello@craftedsignal.io — Wed, 03 Jan 2024 14:30:00 +0000

The S3 Browser utility, a Windows-based client for managing Amazon S3 storage and other cloud services, can be abused by threat actors to create new IAM users or access keys within compromised AWS environments. This activity, if unauthorized, can lead to privilege escalation, persistence, or even initial access, depending on the context of the compromise. The use of S3 Browser is identifiable via the userAgent string in AWS CloudTrail logs. While legitimate use of S3 Browser for administrative tasks exists, its unexpected appearance in user activity, particularly in sensitive accounts, should be investigated. This activity is particularly concerning because it can allow attackers to establish a foothold in the cloud environment and move laterally.

Attack Chain

An attacker gains initial access to an AWS environment, potentially through compromised credentials or an exploited vulnerability.
The attacker installs and configures S3 Browser on a compromised host or uses an existing installation.
The attacker authenticates S3 Browser to the AWS environment using existing compromised credentials or an assumed role.
The attacker uses S3 Browser to execute the CreateUser API call within AWS IAM.
The attacker configures the new IAM user with elevated privileges, potentially granting administrator access.
Alternatively, the attacker uses S3 Browser to execute the CreateAccessKey API call for an existing IAM user.
The attacker uses the newly created access key to perform actions within the AWS environment.
The attacker leverages the new user or access key for persistence, lateral movement, and data exfiltration within the AWS environment.

Impact

Successful exploitation and IAM creation can lead to complete compromise of the AWS environment. An attacker with escalated privileges can access sensitive data, modify configurations, disrupt services, and deploy malicious infrastructure. Depending on the permissions granted to the created user or access key, the attacker could potentially pivot to other AWS accounts or services, leading to widespread damage. This can result in significant financial losses, reputational damage, and regulatory penalties.

Recommendation

Deploy the Sigma rule “AWS IAM S3Browser User or AccessKey Creation” to your SIEM and tune for your environment to detect anomalous IAM activity originating from S3 Browser.
Investigate any instances of CreateUser or CreateAccessKey events in AWS CloudTrail logs where the userAgent contains “S3 Browser”.
Implement multi-factor authentication (MFA) for all IAM users to mitigate the risk of credential compromise.
Review and enforce the principle of least privilege for all IAM users and roles to limit the impact of compromised credentials.

Suspicious AWS STS GetSessionToken Usage

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

The AWS Security Token Service (STS) GetSessionToken API allows IAM users to create temporary security credentials. Attackers can abuse this functionality by generating tokens with elevated privileges or for lateral movement within an AWS environment if an IAM user’s credentials have been compromised. This activity can be difficult to detect as GetSessionToken is a legitimate function, but unusual patterns or IAM users generating tokens where it is not expected should be investigated. This activity is of particular concern because it bypasses normal IAM role assumption logging and creates a separate credential for an attacker to abuse, making access more difficult to track. The impact is significant, allowing attackers to perform actions as the compromised IAM user or escalate privileges.

Attack Chain

An attacker gains initial access to an AWS environment, potentially through compromised IAM user credentials.
The attacker authenticates to AWS using the compromised IAM user credentials.
The attacker calls the STS GetSessionToken API, specifying desired permissions or roles (if permitted by the IAM user’s policies).
AWS STS generates a new set of temporary credentials (access key ID, secret access key, and session token).
The attacker configures their AWS CLI or SDK to use the newly acquired temporary credentials.
The attacker leverages these temporary credentials to perform actions within the AWS environment, potentially escalating privileges or moving laterally.
The attacker covers their tracks by deleting the CloudTrail logs.
The attacker exfiltrates sensitive data, deploys malware, or causes disruption within the AWS environment using the acquired privileges.

Impact

Compromised AWS environments can lead to data breaches, service disruptions, and financial losses. Successful exploitation via GetSessionToken misuse allows attackers to move laterally, escalate privileges, and perform unauthorized actions within the AWS infrastructure. The number of affected organizations is currently unknown, but any organization relying on AWS is potentially at risk. If successful, attackers can steal sensitive data, compromise critical systems, and disrupt business operations.

Recommendation

Deploy the Sigma rule “AWS STS GetSessionToken Misuse” to your SIEM to detect suspicious GetSessionToken API calls (see rules section).
Investigate GetSessionToken calls where userIdentity.type is IAMUser to determine if the request is legitimate.
Monitor CloudTrail logs for unusual patterns of GetSessionToken usage, particularly from unfamiliar user agents or hosts.
Implement strong IAM policies and MFA to minimize the risk of compromised IAM user credentials.
Review the false positives section of the Sigma rule to tune the rule for your specific environment.

Suspicious AWS EC2 Key Pair Creation from Non-Cloud AS

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This alert identifies suspicious activity related to the creation of EC2 key pairs within an AWS environment. Specifically, it focuses on instances where a new IAM principal (user) creates an EC2 key pair from a network source (IP address) whose autonomous system organization is not commonly associated with major cloud providers like Amazon, Google, or Microsoft. Adversaries often create key pairs for persistence or to enable unauthorized access to EC2 instances, potentially leading to data exfiltration or further malicious activities. The rule uses a new terms approach to baseline user activity, reducing noise from repeated actions while still flagging the initial suspicious key pair creation. This activity is flagged as suspicious due to originating from outside trusted ASNs.

Attack Chain

An attacker gains initial access to an AWS account, potentially through compromised credentials or a misconfigured IAM role.
The attacker attempts to enumerate existing EC2 instances and associated key pairs.
The attacker uses the CreateKeyPair API call to generate a new SSH key pair within the AWS account. The request originates from a network with an autonomous system organization not attributed to common cloud providers.
The attacker stores the private key material for later use in accessing EC2 instances.
The attacker may then use the new key pair to launch new EC2 instances or import the key to existing instances. This can be done through RunInstances or ImportKeyPair operations.
The attacker uses the new key pair to SSH into the newly created or compromised EC2 instances.
Once inside the instances, the attacker performs malicious activities, such as data exfiltration, lateral movement, or installing malware.

Impact

Successful exploitation can lead to unauthorized access to EC2 instances, potentially compromising sensitive data and disrupting services. A compromised AWS account can allow the attacker to steal data, establish persistence, and move laterally within the cloud environment. The lack of expected cloud provider ASN for the source IP of the CreateKeyPair event raises the risk profile.

Recommendation

Deploy the Sigma rule “AWS EC2 CreateKeyPair from Non-Cloud AS Organization” to your SIEM and tune the source.as.organization.name exclusions based on your environment.
Review AWS CloudTrail logs for any CreateKeyPair events and correlate with other suspicious activity, as mentioned in the investigation steps in this brief.
Implement stricter IAM policies to limit the ability to create key pairs to only authorized users and roles.
Monitor for RunInstances or ImportKeyPair events using the newly created key names as identified from aws.cloudtrail.request_parameters / response_elements.
Enable and review AWS Config rules to detect and remediate misconfigurations related to IAM and EC2 key pair management.

AWS VPC Flow Logs Deletion for Defense Evasion

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

An adversary with sufficient privileges within an AWS environment may attempt to delete VPC Flow Logs. These logs are crucial for monitoring network traffic within a VPC, and their removal can significantly impede incident response and forensic investigations. The deletion is accomplished by making a DeleteFlowLogs API call. This action is often taken to remove evidence of malicious activity, such as lateral movement, command and control communication, or data exfiltration. The impact of this activity can be severe, potentially allowing attackers to operate undetected for extended periods.

Attack Chain

The attacker gains initial access to the AWS environment through compromised credentials or an exploited vulnerability (not detailed in source).
The attacker escalates privileges within the AWS environment to gain the necessary permissions to delete VPC Flow Logs (not detailed in source).
The attacker uses the AWS CLI or AWS Management Console to execute the DeleteFlowLogs API call.
The attacker identifies the specific Flow Log IDs that need to be deleted.
The attacker authenticates to the AWS API using stolen or generated credentials.
The DeleteFlowLogs API call is made, specifying the Flow Log IDs to be deleted.
AWS processes the request and deletes the specified VPC Flow Logs.
The attacker verifies the deletion of the Flow Logs to ensure that their actions are no longer being logged.

Impact

Successful deletion of VPC Flow Logs prevents security teams from detecting malicious activity within the AWS environment. Without these logs, it becomes significantly more difficult to investigate security incidents, track attacker movements, and understand the scope of a compromise. This can lead to delayed incident response, increased dwell time for attackers, and greater overall damage. The absence of flow logs severely limits network visibility, hindering any attempt to reconstruct events or identify compromised assets.

Recommendation

Implement the Sigma rule “AWS VPC Flow Logs Deleted” to detect instances of DeleteFlowLogs API calls (reference: rules section).
Monitor CloudTrail logs for DeleteFlowLogs events and investigate any unexpected occurrences (reference: logsource).
Enforce the principle of least privilege to restrict IAM users and roles from having the ec2:DeleteFlowLogs permission unless absolutely necessary.
Implement multi-factor authentication (MFA) for all AWS accounts, especially those with administrative privileges.
Regularly review and audit IAM policies to ensure that permissions are appropriately scoped and not overly permissive.

AWS STS GetFederationToken with AdministratorAccess in Request

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

The AWS Security Token Service (STS) GetFederationToken API allows for the creation of temporary security credentials for federated users. These credentials inherit permissions from the calling IAM user and any session policy included in the request. This detection focuses on instances where the request parameters of GetFederationToken reference AdministratorAccess, either directly or through an equivalent string. The inclusion of AdministratorAccess within the session policy grants overly broad privileges to the temporary credentials, potentially leading to privilege escalation or abuse. This scenario is often indicative of legacy systems, misconfigured tooling, or malicious intent, posing a significant risk to the security posture of AWS environments. Defenders should prioritize identifying and mitigating instances of this behavior to enforce least privilege principles and prevent unauthorized access.

Attack Chain

An attacker gains initial access to an AWS account, potentially through compromised IAM user credentials or an exploited vulnerability.
The attacker identifies an IAM user with the necessary permissions to call the STS GetFederationToken API.
The attacker crafts a GetFederationToken API request, including a session policy that directly references “AdministratorAccess” or includes a policy ARN that grants administrator privileges.
The GetFederationToken API call is successfully executed, generating temporary security credentials with broad administrator permissions.
The attacker uses the temporary credentials to perform privileged actions within the AWS environment, such as modifying IAM policies, accessing sensitive data, or deploying malicious resources.
The attacker may attempt to laterally move within the AWS environment by leveraging the newly acquired administrator privileges to compromise other resources or accounts.
The attacker could establish persistence by creating new IAM users or roles with elevated permissions, ensuring continued access even after the temporary credentials expire.
The attacker achieves their final objective, which could include data exfiltration, service disruption, or financial gain.

Impact

Successful exploitation can lead to complete compromise of the AWS environment. An attacker with temporary administrator credentials can modify security configurations, access sensitive data, and disrupt critical services. While no specific victim counts or sectors are mentioned, the broad permissions granted by AdministratorAccess make any AWS environment vulnerable to significant damage. The risk score of 73 highlights the potential for severe impact.

Recommendation

Deploy the Sigma rule “AWS STS GetFederationToken with AdministratorAccess in Request” to your SIEM to detect instances of this activity (rule title).
Investigate any alerts generated by the Sigma rule, focusing on the aws.cloudtrail.request_parameters to identify the specific policy being used (rule title).
Revoke or rotate the IAM user access keys involved in the GetFederationToken call and enforce least privilege on the user (rule description).
Monitor CloudTrail logs for subsequent events using response_elements.credentials.accessKeyId from the same response to identify actions taken with the temporary credentials (rule description).
Review and update IAM policies to ensure that session policies used with GetFederationToken adhere to the principle of least privilege (rule description).
Implement automated checks to prevent the creation or modification of IAM policies that grant AdministratorAccess except in explicitly approved scenarios (rule description).

AWS IAM Customer Managed Policy Version Manipulation for Privilege Escalation

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This detection identifies potentially malicious activity related to AWS Identity and Access Management (IAM) policies. Specifically, it focuses on the creation of new versions of customer-managed policies (CreatePolicyVersion) and the modification of the default version (SetDefaultPolicyVersion). Attackers who have compromised IAM users or roles with sufficient permissions (iam:CreatePolicyVersion or iam:SetDefaultPolicyVersion) can use these actions to escalate their privileges within the AWS environment. By introducing a more permissive policy version and setting it as the default, attackers can gain unauthorized access to resources and perform actions that would otherwise be restricted. This activity is especially concerning when the modified policies are attached to highly privileged roles or users, such as those used for administrative tasks or break-glass scenarios.

Attack Chain

An attacker compromises an IAM user or role with permissions to modify IAM policies (iam:CreatePolicyVersion or iam:SetDefaultPolicyVersion).
The attacker identifies a customer-managed policy attached to a high-privilege role or user.
The attacker crafts a new policy version with overly permissive rules, such as wildcard actions and resources.
The attacker uses the CreatePolicyVersion API call to upload the malicious policy version to the target policy.
Alternatively, the attacker uses the SetDefaultPolicyVersion API call to set a pre-existing, but less restrictive, policy version as the default.
The compromised IAM user or role assumes the high-privilege role targeted in step 2.
The attacker gains elevated privileges based on the modified IAM policy.
The attacker performs unauthorized actions within the AWS environment, such as accessing sensitive data, modifying infrastructure, or creating new resources.

Impact

Successful exploitation can lead to significant privilege escalation, allowing attackers to gain control over critical AWS resources and data. The number of affected users and roles depends on the scope of the compromised policy and its attachments. The consequences can include data breaches, service disruptions, and financial losses. In environments where IAM policies are not closely monitored, attackers may be able to maintain their elevated access for extended periods, further compounding the damage.

Recommendation

Deploy the Sigma rule “AWS IAM Customer Managed Policy Version Created or Default Version Set” to your SIEM to detect suspicious policy modifications. Tune the rule based on your organization’s baseline activity.
Review aws.cloudtrail.request_parameters logs to identify the policyArn and policyDocument associated with the policy changes detected by the rule.
Implement strong IAM governance practices, including the principle of least privilege and regular reviews of policy permissions, to minimize the impact of policy manipulation.
Monitor CloudTrail logs for AttachUserPolicy, AttachRolePolicy, or CreatePolicyVersion spikes from the same principal as detected policy modifications.
Enable MFA for all IAM users, especially those with permissions to manage IAM policies.

AWS EC2 Stop, Start, and User Data Modification Correlation

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This detection identifies a specific sequence of AWS EC2 API calls suggesting malicious intent. An adversary may update the userData attribute of an EC2 instance and then restart the instance to execute malicious scripts with elevated privileges (root on Linux, SYSTEM on Windows). The technique involves modifying instance attributes to inject malicious code or scripts, followed by stopping and starting the instance to trigger execution of the modified user data. This can lead to privilege escalation, persistence, or other malicious activities within the AWS environment. The detection focuses on the correlation of StopInstances, StartInstances, and ModifyInstanceAttribute events that reference userData within a 5-minute window. The rule groups these events by instance ID, username, account ID, source IP, and user agent, triggering an alert only when all three distinct API calls are observed within the same group. This aims to reduce false positives by requiring the complete sequence of actions associated with this technique.

Attack Chain

An attacker gains initial access to an AWS account with sufficient permissions to manage EC2 instances (e.g., via compromised credentials or an IAM role).
The attacker identifies a target EC2 instance.
The attacker uses the ModifyInstanceAttribute API call to update the userData attribute of the target instance, injecting malicious code or scripts.
The attacker uses the StopInstances API call to stop the target EC2 instance.
The attacker uses the StartInstances API call to start the target EC2 instance.
Upon instance start, the modified userData script executes with elevated privileges, potentially installing malware, establishing persistence, or performing other malicious actions.
The attacker may use the compromised instance to further explore the AWS environment, escalate privileges, or exfiltrate data.

Impact

Successful exploitation can lead to unauthorized code execution within the AWS environment. Attackers can gain elevated privileges on the compromised EC2 instance, potentially leading to full control of the instance and the ability to access sensitive data or resources within the AWS account. This can result in data breaches, service disruptions, and financial losses. The modification of user data allows for persistent malicious code execution each time the instance restarts.

Recommendation

Deploy the following Sigma rules to your SIEM to detect the described attack pattern, and tune them to your environment.
Review CloudTrail logs for ModifyInstanceAttribute events with userData to identify potentially malicious modifications.
Monitor EC2 instance state transitions (stop/start) in conjunction with user data modifications.
Implement least privilege IAM policies to restrict access to EC2 management APIs.
Use AWS Secrets Manager or Parameter Store to manage secrets instead of embedding them in userData.
Investigate any alerts generated by the Sigma rules and correlate them with other security events.

AWS EC2 Instance Profile Associated with Running Instance

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This threat brief focuses on the potential for privilege escalation and lateral movement within Amazon Web Services (AWS) environments by abusing the ability to associate or replace IAM instance profiles on running EC2 instances. An attacker with the necessary permissions (ec2:AssociateIamInstanceProfile or ec2:ReplaceIamInstanceProfile and typically iam:PassRole) can elevate the privileges of a compromised EC2 instance. This is achieved by attaching a more privileged IAM role to the instance, granting the attacker access to resources and permissions beyond their initial scope. The event is logged in AWS CloudTrail, providing a critical detection opportunity for security teams.

Attack Chain

An attacker gains initial access to an AWS account, potentially through compromised credentials or a vulnerable application.
The attacker identifies a running EC2 instance with limited privileges.
The attacker identifies or creates a more privileged IAM role that grants broader access to AWS resources.
The attacker uses the AssociateIamInstanceProfile or ReplaceIamInstanceProfile API calls to associate the privileged IAM role with the target EC2 instance. This requires appropriate IAM permissions.
The EC2 instance’s metadata service now provides credentials for the newly associated IAM role.
The attacker leverages the elevated privileges to access sensitive data or resources, potentially including other EC2 instances, databases, or storage buckets.
The attacker moves laterally within the AWS environment, compromising additional resources and escalating their access.
The attacker achieves their objective, such as exfiltrating data, deploying malicious code, or disrupting services.

Impact

Successful exploitation allows attackers to elevate privileges within the AWS environment, potentially leading to unauthorized access to sensitive data, lateral movement to other systems, and disruption of critical services. The impact could range from data breaches and financial losses to reputational damage and regulatory fines. Identifying and responding to these events quickly is crucial to minimizing potential damage.

Recommendation

Deploy the Sigma rule “AWS EC2 Instance Profile Associated with Running Instance” to your SIEM using AWS CloudTrail logs to detect suspicious activity.
Review and harden IAM permissions related to ec2:AssociateIamInstanceProfile and ec2:ReplaceIamInstanceProfile to limit who can modify instance profiles.
Enable CloudTrail logging for all regions in your AWS account to ensure comprehensive audit coverage.
Implement least privilege principles for IAM roles assigned to EC2 instances to minimize the impact of potential privilege escalation.
Investigate any alerts generated by the Sigma rule, focusing on the source IP address, user identity, and the IAM role associated with the instance profile.

AWS AssumeRoleWithWebIdentity from Kubernetes SA and External ASN

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This detection rule identifies instances of successful AWS AssumeRoleWithWebIdentity calls originating from a Kubernetes service account but not from an Amazon-managed Autonomous System Number (ASN). The primary concern is the potential compromise or misuse of projected service account tokens. Kubernetes service accounts can be mapped to IAM roles through OIDC using IRSA (IAM Roles for Service Accounts). Typically, these credential requests originate from within AWS-managed or associated networks. However, if a request with a Kubernetes service account identity originates from an external ASN (i.e., not Amazon.com, Inc.), it raises suspicion that the token might have been exfiltrated and is being used from an unauthorized location. This rule is designed to highlight such anomalies, prompting further investigation into possible token theft or misconfiguration.

Attack Chain

Attacker gains unauthorized access to a Kubernetes service account token within a compromised pod or through other means.
Attacker exfiltrates the service account token from the Kubernetes cluster.
The attacker uses the exfiltrated token to call the AWS STS AssumeRoleWithWebIdentity API.
The AssumeRoleWithWebIdentity call is made from a network with an ASN organization name that is not Amazon.com, Inc..
AWS CloudTrail logs the successful AssumeRoleWithWebIdentity event, including details about the user, source IP, and ASN organization.
The compromised IAM role is used to perform unauthorized actions within the AWS environment.
These actions could include data exfiltration, resource modification, or further lateral movement within the cloud infrastructure.

Impact

A successful attack of this nature can lead to significant security breaches within an AWS environment. An attacker leveraging stolen service account tokens can gain unauthorized access to sensitive resources, leading to data breaches, service disruption, or financial loss. This is especially concerning for organizations heavily reliant on Kubernetes and AWS, as it can undermine the security of their cloud-native applications and infrastructure. While the number of affected organizations is unknown, the potential impact on those targeted can be severe, leading to substantial remediation costs and reputational damage.

Recommendation

Deploy the Sigma rule AWS AssumeRoleWithWebIdentity from Kubernetes SA and External ASN to your SIEM and tune for your environment.
Investigate any alerts generated by the Sigma rule by following the investigation steps in the rule’s note field.
Expand the source.as.organization.name exclusions in the Sigma rule for known and trusted egress paths if needed.
Enable geolocation/ASN enrichment for your AWS CloudTrail logs to accurately identify the source of AssumeRoleWithWebIdentity calls.
Regularly review and rotate IRSA trust relationships to minimize the impact of compromised service account tokens.
Revoke the role session, rotate IRSA trust where appropriate, investigate token exposure, and reduce service account and role permissions if unauthorized access is suspected.

AWS Root Account Usage Detected

hello@craftedsignal.io — Tue, 02 Jan 2024 14:30:00 +0000

The use of the AWS root account should be strictly limited to specific tasks that cannot be performed with IAM users or roles. This alert indicates that the root account was used, which could signify various security concerns. An attacker with access to the root account can perform any action within the AWS environment, including creating new users, modifying security policies, accessing sensitive data, and deleting resources. Defenders should investigate each instance of root account usage to determine legitimacy. This activity may also indicate a misconfiguration where IAM roles should be used.

Attack Chain

An attacker gains access to the AWS root account credentials through credential theft or other means.
The attacker authenticates to the AWS Management Console or uses the AWS CLI with the root account credentials.
The attacker enumerates AWS resources to identify potential targets for privilege escalation.
The attacker creates or modifies IAM policies to grant themselves additional permissions.
The attacker may create new IAM users or roles with elevated privileges.
The attacker uses the elevated privileges to access sensitive data stored in S3 buckets or other AWS services.
The attacker modifies security configurations, such as network access control lists or security groups, to facilitate lateral movement or data exfiltration.
The attacker could disable logging features to cover tracks.

Impact

Compromise of the AWS root account can lead to a complete breach of the AWS environment, resulting in unauthorized access to sensitive data, data loss, service disruption, and potential financial losses. Attackers can leverage root privileges to perform nearly any action within the AWS account, affecting all services and resources. The number of affected victims depends on the scope and criticality of the AWS environment.

Recommendation

Deploy the Sigma rule “AWS Root Credentials” to your SIEM to detect root account usage based on CloudTrail logs.
Investigate all instances of root account usage identified by the “AWS Root Credentials” Sigma rule to determine legitimacy.
Enforce multi-factor authentication (MFA) on all AWS accounts, including the root account, as documented in AWS documentation.
Implement the principle of least privilege by granting IAM users and roles only the permissions they need to perform their tasks.
Regularly audit IAM policies and user permissions to identify and remove unnecessary privileges.
Disable or restrict root account access wherever possible, delegating tasks to IAM users/roles.

AWS S3 Bucket Deletion Detected via CloudTrail

hello@craftedsignal.io — Tue, 02 Jan 2024 14:27:00 +0000

The deletion of S3 buckets is a critical event to monitor in AWS environments. While legitimate administrative actions may involve bucket deletion, unauthorized or accidental removal of buckets can lead to significant data loss and business disruption. This brief focuses on detecting such events through AWS CloudTrail logs, which record API calls made within the AWS infrastructure. Monitoring for DeleteBucket events helps identify potential malicious activity or unintentional misconfigurations that could compromise data availability and integrity. This detection focuses on identifying DeleteBucket API calls, successful or otherwise, within CloudTrail logs to provide early warning of potential data compromise.

Attack Chain

An attacker gains unauthorized access to an AWS account through compromised credentials or a privilege escalation exploit.
The attacker lists existing S3 buckets to identify potential targets using the ListBuckets API call.
The attacker identifies a target S3 bucket containing sensitive data.
The attacker attempts to delete the target S3 bucket by issuing a DeleteBucket API call using the AWS CLI or SDK.
CloudTrail logs the DeleteBucket event, including the user identity, timestamp, and bucket name.
If successful, the S3 bucket and its contents are permanently deleted.
The attacker may attempt to remove CloudTrail logs to cover their tracks, using the DeleteTrail API call.

Impact

The deletion of an S3 bucket results in the permanent loss of all data stored within that bucket. This can lead to service disruption, data breaches, and financial losses, especially if the bucket contained critical business data or backups. The impact can range from temporary inconvenience to complete business failure depending on the criticality of the data lost and the organization’s backup and recovery capabilities. Without proper monitoring and alerting, an S3 bucket deletion can go unnoticed for extended periods, hindering incident response efforts and potentially exacerbating the damage.

Recommendation

Deploy the provided Sigma rule to your SIEM to detect S3 bucket deletion events in CloudTrail logs.
Investigate any detected DeleteBucket events to verify their legitimacy and ensure they were authorized by appropriate personnel.
Implement multi-factor authentication (MFA) for all AWS accounts to prevent unauthorized access and reduce the risk of credential compromise.
Enforce strict IAM policies and regularly review user permissions to minimize the blast radius of compromised accounts.
Enable versioning on S3 buckets to allow for the recovery of accidentally deleted objects, mitigating the impact of data loss.
Implement data backup and disaster recovery plans to ensure business continuity in the event of a successful bucket deletion attack.

S3 Browser Used to Create IAM Login Profiles

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

The threat involves the use of the S3 Browser utility, a Windows application, to interact with Amazon Web Services (AWS) Identity and Access Management (IAM). Attackers are leveraging S3 Browser to perform reconnaissance, specifically targeting IAM users that do not have a login profile configured. Upon identifying such users, the attacker proceeds to create a login profile for them. This tactic may be indicative of an attempt to gain unauthorized access or maintain persistence within the AWS environment. The activity is detectable via AWS CloudTrail logs and was first publicly reported in May 2023 in connection with the threat actor GUIVIL.

Attack Chain

Attacker gains initial access to a system with AWS CLI tools installed or uses a compromised IAM user with sufficient permissions.
The attacker configures S3 Browser with valid AWS credentials, enabling interaction with the AWS environment.
S3 Browser initiates a GetLoginProfile API call in AWS CloudTrail, to enumerate IAM users and identify those without existing login profiles.
S3 Browser, upon finding an IAM user without a login profile, initiates a CreateLoginProfile API call.
The attacker sets a password for the newly created login profile, gaining console access to the targeted IAM user account.
The attacker logs into the AWS console using the newly created credentials.
The attacker leverages the IAM user’s permissions to perform further reconnaissance, lateral movement, or data exfiltration within the AWS environment.
The attacker establishes persistence by maintaining access through the created login profile, even if other access methods are revoked.

Impact

Successful exploitation allows attackers to gain unauthorized console access to previously unprotected IAM user accounts. This can lead to privilege escalation, data breaches, and disruption of cloud services. The lack of multi-factor authentication on newly created login profiles increases the risk of account compromise. The impact can range from reconnaissance to full-scale control of the AWS environment, depending on the permissions associated with the compromised IAM users.

Recommendation

Deploy the provided Sigma rule to your SIEM to detect GetLoginProfile and CreateLoginProfile events originating from the S3 Browser user agent in AWS CloudTrail logs.
Investigate any instances of IAM LoginProfile creation originating from unusual user agents or IP addresses.
Implement multi-factor authentication (MFA) for all IAM users, including those with console access to mitigate the impact of compromised credentials.
Review IAM policies to ensure least privilege and restrict the ability to create or modify LoginProfiles to authorized personnel only.

AWS GuardDuty IP Set Manipulation for Defense Impairment

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

An adversary may attempt to impair an organization’s defenses by manipulating the IP sets within AWS GuardDuty. GuardDuty IP sets are used to whitelist trusted IPs or blacklist known malicious IPs. By modifying these lists, an attacker can effectively disable alerts for their malicious activity, allowing them to operate undetected within the AWS environment. This activity is typically performed after initial access and lateral movement, as the attacker seeks to maintain persistence and evade detection. The changes could be made via the AWS Management Console, CLI, or programmatically through the AWS API, making it difficult to immediately recognize the change as malicious.

Attack Chain

The attacker gains initial access to the AWS environment through compromised credentials or an exposed IAM role.
The attacker enumerates existing GuardDuty IP sets using the ListIPSets API call to identify potential targets for modification.
The attacker creates a new IP set using CreateIPSet API call, which contains malicious IPs they intend to whitelist, or the legitimate IPs of internal scanners they wish to mimic.
GuardDuty validates the uploaded IP set list.
The attacker activates the newly created IP set within GuardDuty, making it the active trusted or threat list.
The attacker conducts malicious activity, such as lateral movement, data exfiltration, or resource exploitation, from the whitelisted IPs.
GuardDuty, configured with the modified IP sets, does not generate alerts for activity originating from the whitelisted IPs.
The attacker maintains persistence and achieves their objective (e.g., data theft, denial of service) without detection.

Impact

A successful attack can lead to significant data breaches, resource compromise, and prolonged unauthorized access. The modification of IP sets within GuardDuty directly impairs the ability of security teams to detect and respond to ongoing threats. By whitelisting malicious IPs, attackers can bypass security controls and operate freely within the AWS environment. The number of affected organizations depends on the scope of the compromised AWS accounts and the extent to which GuardDuty is relied upon for threat detection.

Recommendation

Deploy the Sigma rule “AWS GuardDuty IP Set Creation” to your SIEM to detect suspicious creation of IP sets in GuardDuty (logsource: aws, service: cloudtrail).
Investigate any changes to GuardDuty configurations, particularly the creation or modification of IP sets, using CloudTrail logs.
Implement multi-factor authentication (MFA) for all AWS accounts and IAM roles to prevent unauthorized access (related to initial access).
Regularly review and audit IAM roles and permissions to minimize the blast radius of compromised credentials.

AWS Config Service Disabling Detection

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

This threat brief focuses on detecting the disabling of AWS Config, a service that continuously monitors and records AWS resource configurations. An attacker might disable AWS Config to evade detection and prevent auditing of their malicious activities within the AWS environment. By deleting delivery channels or stopping the configuration recorder, an attacker can effectively blind the security team to changes made to AWS resources. This activity, if unauthorized, signifies a significant attempt to impair defenses. This brief provides detections based on AWS CloudTrail logs.

Attack Chain

An attacker gains unauthorized access to an AWS account, potentially through compromised credentials or exploiting a vulnerability.
The attacker enumerates existing AWS Config resources to identify the delivery channel and configuration recorder.
The attacker executes the DeleteDeliveryChannel API call to stop the delivery of configuration changes to the designated S3 bucket or SNS topic.
The attacker executes the StopConfigurationRecorder API call to halt the recording of configuration changes for AWS resources.
The attacker performs malicious actions within the AWS environment without the activity being recorded by AWS Config.
The attacker may attempt to delete CloudTrail logs, if they have sufficient permissions, to further cover their tracks.
The attacker achieves their objective, such as deploying malicious infrastructure, exfiltrating data, or disrupting services, without immediate detection.

Impact

Successful disabling of AWS Config allows attackers to operate undetected within an AWS environment. This can lead to a delayed response to security incidents, resulting in more significant data breaches, financial losses, or reputational damage. The number of affected AWS accounts and the scope of the damage depend on the attacker’s objectives and the duration of the undetected activity.

Recommendation

Deploy the Sigma rule “AWS Config Disabling Channel/Recorder” to your SIEM and tune for your environment to detect unauthorized disabling of AWS Config resources.
Review AWS IAM policies to ensure that only authorized personnel have the necessary permissions to modify or disable AWS Config settings.
Implement multi-factor authentication (MFA) for all AWS accounts to reduce the risk of credential compromise.
Monitor CloudTrail logs for any attempts to disable or modify AWS Config resources, referencing the eventSource and eventName fields in the provided Sigma rule.