https://feed.craftedsignal.io/tags/rolesanywhere/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 08 May 2024 12:00:00 +0000https://feed.craftedsignal.io/briefs/2024-05-aws-iam-roles-anywhere-profile-creation/Wed, 08 May 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-05-aws-iam-roles-anywhere-profile-creation/Detection of AWS IAM Roles Anywhere profile creation, potentially indicating an adversary establishing persistence or escalating privileges through rogue trust anchors to gain long-term external access.AWS IAM Roles Anywhere enables external workloads to assume IAM roles securely, using certificates from trusted anchors. A profile links IAM roles to trust anchors and defines session duration. This detection identifies the "CreateProfile" API call, which adversaries may use to create or modify profiles, linking them with highly privileged roles or unauthorized trust anchors. This allows for long-term external access to the AWS environment. The rule focuses on successful 'CreateProfile' API calls. It is important to monitor profile creation to ensure that only approved roles and trust anchors are in use. This activity can lead to persistence and privilege escalation.

Attack Chain

1. The adversary compromises an external system or obtains unauthorized access to a trusted certificate authority.
2. The adversary establishes a rogue trust anchor within AWS IAM Roles Anywhere, representing the compromised CA or external system.
3. The attacker leverages the CreateProfile API call to create a new IAM Roles Anywhere profile.
4. The profile is configured to associate the rogue trust anchor with one or more IAM roles. The roleArns parameter within the request_parameters should be closely monitored for excessive permissions.
5. The adversary sets a long durationSeconds for the profile, maximizing the window of opportunity for assuming roles.
6. The attacker uses the AssumeRoleWithCertificate API call, presenting a valid certificate issued by the compromised CA, to assume an IAM role associated with the newly created profile.
7. The assumed role is then used to perform unauthorized actions within the AWS environment, such as accessing sensitive data, modifying infrastructure, or deploying malicious code.
8. The adversary maintains persistent access to the AWS environment through the compromised trust anchor and associated profile, enabling long-term control.

Impact

Successful exploitation can grant unauthorized external access to the AWS environment. This may lead to data breaches, service disruption, or the deployment of malicious infrastructure. While the source provides no specific numbers, the impact depends on the privileges associated with the assumed roles and the extent of the adversary's lateral movement within the AWS environment. Compromised Roles Anywhere profiles can provide persistent access, making detection and remediation critical.

Recommendation

• Deploy the Sigma rule AWS IAM Roles Anywhere Profile Creation to your SIEM and tune for your environment to detect unauthorized profile creation events.
• Restrict rolesanywhere:CreateProfile API calls to a small set of administrative roles within your AWS environment to prevent unauthorized profile creation.
• Implement AWS Config or Security Hub controls to alert on unauthorized or overly permissive Roles Anywhere profiles, as mentioned in the overview section.
• Review IAM role trust policies linked to external anchors, ensuring adherence to the principle of least privilege to minimize the impact of compromised profiles.

]]>lowadvisoryawsiamrolesanywherepersistenceprivilege-escalationhttps://feed.craftedsignal.io/briefs/2024-05-aws-roles-anywhere-trust-anchor-external-ca/Thu, 02 May 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-05-aws-roles-anywhere-trust-anchor-external-ca/The creation of an AWS IAM Roles Anywhere Trust Anchor using an external Certificate Authority (CA) instead of an AWS-managed CA allows adversaries to establish persistent access by using their own CA to sign certificates for authentication.AWS IAM Roles Anywhere allows workloads outside AWS to assume IAM roles by presenting X.509 certificates. A trust anchor defines which certificate authority (CA) AWS trusts to validate these external identities. This rule detects when a trust anchor is created using an external CA (sourceType= "CERTIFICATE_BUNDLE" or "SELF_SIGNED_REPOSITORY") rather than an ACM-managed CA (sourceType="AWS_ACM_PCA"). An adversary establishing persistent external access can exploit this by authenticating using certificates signed by their own CA, even after key rotation. This activity is logged by CloudTrail, and this rule focuses on detecting the CreateTrustAnchor event with a non-AWS CA source type, potentially indicating unauthorized federation attempts.

Attack Chain

1. The attacker gains initial access to an AWS account with sufficient privileges to manage IAM Roles Anywhere.
2. The attacker uses the CreateTrustAnchor API to register an external CA as a trusted root for Roles Anywhere. This involves setting the sourceType to CERTIFICATE_BUNDLE or SELF_SIGNED_REPOSITORY instead of AWS_ACM_PCA.
3. The attacker creates an IAM Roles Anywhere profile, associating it with the newly created trust anchor and one or more IAM roles.
4. The attacker generates a client certificate signed by their external CA.
5. The attacker uses the AssumeRoleWithCertificate API call, presenting the client certificate to assume the associated IAM role.
6. The attacker can now perform actions within the AWS environment with the privileges of the assumed IAM role.
7. The attacker maintains persistent access even after standard credential rotation by generating new certificates signed by their trusted CA.
8. The final objective is often to maintain long-term access to AWS resources, potentially for data exfiltration, lateral movement, or other malicious activities.

Impact

Successful exploitation allows attackers to establish persistent access to AWS environments from outside the AWS infrastructure. This can lead to unauthorized access to sensitive data, lateral movement within the AWS environment, and potentially complete compromise of the AWS account. This scenario can bypass standard AWS security controls and makes credential rotation ineffective. The number of victims is currently unknown, but any organization using AWS IAM Roles Anywhere is potentially vulnerable.

Recommendation

• Deploy the Sigma rule "AWS IAM Roles Anywhere Trust Anchor Created with External CA" to your SIEM to detect unauthorized trust anchor creations (rule).
• Monitor AWS CloudTrail logs for CreateTrustAnchor events and validate the sourceType to ensure only authorized CAs are used (log source).
• Restrict rolesanywhere:CreateTrustAnchor permissions to only authorized security administrators (reference).
• Implement AWS Config rules or Security Hub findings to detect anomalous IAM and Roles Anywhere behavior (reference).
• Regularly review existing trust anchors and profiles in IAM Roles Anywhere to identify and remove any unauthorized configurations (reference).

]]>mediumadvisoryawsiamrolesanywherepersistence