Attack Chain

1. An attacker gains unauthorized access to a user account via compromised credentials or other means.
2. The attacker logs into the AWS Management Console or utilizes AWS CLI with the compromised credentials.
3. The attacker initiates a cloud provisioning action, such as creating a new EC2 instance or launching a new service, from a region not previously associated with the account.
4. AWS CloudTrail logs the "started" or "created" event for the provisioned resource, including the source IP address, user, object, and command used.
5. The detection logic identifies the previously unseen region based on the source IP address using GeoIP enrichment.
6. An alert is triggered, indicating anomalous provisioning activity from an unfamiliar region.
7. The attacker continues to deploy resources in the new region, potentially for malicious purposes such as cryptocurrency mining or hosting command and control infrastructure.

Impact

A successful attack could lead to unauthorized resource deployment, potentially resulting in significant financial costs. Data exfiltration from newly provisioned resources could expose sensitive data leading to compliance violations, legal ramifications, and reputational damage. Further, unauthorized access could allow the attacker to establish a foothold within the cloud environment, enabling lateral movement and further compromise of other resources. The impact will vary based on the compromised user's permissions and the scope of resources the attacker can provision.

Recommendation

• Enable AWS CloudTrail logging in all regions to capture cloud provisioning events.
• Run the baseline search to build the previously_seen_cloud_provisioning_activity_sources lookup table as described in the "How to Implement" section.
• Deploy the Sigma rule Cloud Provisioning Activity From Previously Unseen Region to your SIEM and tune it based on your organization's baseline activity.
• Investigate any alerts generated by the Sigma rule, focusing on the src, Region, user, object, and command fields to understand the context of the provisioning activity.
• Implement multi-factor authentication (MFA) for all user accounts to reduce the risk of credential compromise.
• Review and restrict IAM permissions to follow the principle of least privilege, limiting the resources that a compromised user can access or provision.