Dynamodb - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/dynamodb/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 15:00:00 +0000AWS DynamoDB Table Export to S3 Detectionhttps://feed.craftedsignal.io/briefs/2024-01-aws-dynamodb-exfiltration/Wed, 03 Jan 2024 15:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-aws-dynamodb-exfiltration/Detects the initial export of an AWS DynamoDB table to S3, potentially indicating reconnaissance or exfiltration by a compromised account or insider threat.This alert detects the ExportTableToPointInTime operation in AWS CloudTrail logs, specifically when a user or role performs this action for the first time. Adversaries may leverage this operation to collect sensitive data or exfiltrate entire DynamoDB tables to S3 buckets for unauthorized access or analysis. This activity can be a precursor to data breaches or indicative of compromised credentials. The detection focuses on the initial observation of this action to reduce false positives and highlight potentially anomalous behavior that requires investigation. The targeted logs are AWS CloudTrail logs.

Attack Chain

  1. An attacker gains unauthorized access to an AWS account, potentially through compromised credentials or an exposed IAM role.
  2. The attacker enumerates DynamoDB tables within the AWS environment to identify targets containing sensitive information.
  3. The attacker executes the ExportTableToPointInTime API call to export a DynamoDB table to an S3 bucket. This requires appropriate IAM permissions.
  4. The exported data is stored in the designated S3 bucket in a format suitable for offline analysis.
  5. The attacker accesses the exported data from the S3 bucket.
  6. The attacker exfiltrates the data from the S3 bucket.
  7. The attacker analyzes or uses the exfiltrated data for malicious purposes.

Impact

A successful attack could lead to the exfiltration of sensitive data stored in DynamoDB tables, including customer information, financial records, or proprietary business data. This can result in significant financial losses, reputational damage, and legal liabilities for the affected organization. The number of affected records would depend on the size of the exported DynamoDB table. Organizations in all sectors are potentially at risk if they use DynamoDB to store sensitive information.

Recommendation

  • Deploy the Sigma rule Detect First Time DynamoDB Table Export to S3 to your SIEM, focusing on the aws.cloudtrail data stream, to identify initial instances of this activity.
  • Investigate any alerts generated by the Sigma rule, focusing on the aws.cloudtrail.user_identity.arn, source.ip, and aws.cloudtrail.request_parameters fields to understand the context of the export operation.
  • Review IAM policies to ensure that users and roles have the appropriate least-privilege access to DynamoDB tables, preventing unauthorized export operations.
  • Monitor the cloud.account.id and user.name fields flagged by the new_terms rule to ensure that only authorized accounts and users are performing DynamoDB table exports.
]]>lowadvisoryawsdynamodbexfiltrationAWS DynamoDB Scan by Unusual Userhttps://feed.craftedsignal.io/briefs/2024-01-02-aws-dynamodb-scan-unusual-user/Tue, 02 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-02-aws-dynamodb-scan-unusual-user/Detection of unusual DynamoDB scan activity in AWS environments, potentially indicating exfiltration of sensitive information by an adversary using compromised credentials or a rogue insider.This rule identifies when an AWS DynamoDB table is scanned by a user who does not typically perform this action, potentially indicating exfiltration of sensitive information or data from DynamoDB tables. The "AWS DynamoDB Scan by Unusual User" rule, based on the original Elastic detection rule created on 2025/03/13 and last updated on 2026/04/10, monitors for the Scan action in CloudTrail logs. The rule leverages a New Terms approach, flagging when this behavior is observed by a user or role for the first time within a specified history window. This allows for the detection of anomalous activity which might be missed by static threshold-based alerts. The scope is limited to AWS environments where CloudTrail logging is enabled for DynamoDB data events.

Attack Chain

  1. Initial Access: An attacker gains unauthorized access to an AWS account, possibly through compromised credentials or a rogue insider.
  2. Credential Usage: The attacker leverages the compromised AWS credentials to interact with the AWS environment.
  3. Discovery: The attacker uses AWS APIs or the AWS Management Console to discover DynamoDB tables within the environment.
  4. Privilege Escalation (Optional): If necessary, the attacker attempts to escalate privileges to gain access to tables they are not normally authorized to access.
  5. Data Collection: The attacker uses the Scan operation against a DynamoDB table to collect data. The request parameters within the CloudTrail logs include details of the table being scanned.
  6. Staging (Optional): The attacker might stage the collected data in a temporary location within AWS, such as an S3 bucket.
  7. Exfiltration: The attacker exfiltrates the collected data outside the AWS environment.
  8. Covering Tracks: The attacker attempts to cover their tracks by deleting CloudTrail logs, although this action itself can be detectable.

Impact

Successful exfiltration can lead to significant data breaches, potentially affecting sensitive customer information, financial records, or proprietary business data. The impact includes financial losses due to regulatory fines, legal repercussions, reputational damage, and the cost of incident response. Even a successful attempt to discover DynamoDB tables may reveal information about the cloud environment.

Recommendation

  • Enable DynamoDB data events in CloudTrail to capture the Scan action as mentioned in the setup notes.
  • Deploy the provided Sigma rule to detect unusual DynamoDB Scan activity and tune it to reduce false positives.
  • Investigate any alerts generated by the Sigma rule, focusing on the source IP, user identity, and the request parameters of the Scan action, as described in the rule's notes.
  • Review and harden IAM policies associated with users and roles to restrict access to DynamoDB tables based on the principle of least privilege.
  • Monitor CloudTrail logs for unusual API calls and access patterns, including the use of aws.cloudtrail.user_identity.access_key_id for unusual activity.
  • Leverage the rule.investigation_fields to build dashboards and hunting queries in your SIEM to support the triage process.
]]>lowadvisoryawsdynamodbexfiltrationcloudtrail