Sns - CraftedSignal Threat Feed

AWS SNS Rare Protocol Subscription by User

hello@craftedsignal.io — Fri, 22 Nov 2024 12:00:00 +0000

This detection identifies when a user subscribes to an Amazon Simple Notification Service (SNS) topic using a protocol type that is new for that user. SNS allows subscriptions via various protocols, including email, SMS, Lambda functions, and HTTP endpoints. An adversary might exploit this feature to collect sensitive information or exfiltrate data by subscribing with an external email address, a cross-account AWS service, or other means. This "new terms" rule specifically triggers when a previously unseen protocol is used for a subscription by a given user, helping to surface potentially malicious or anomalous activity within an AWS environment.

Attack Chain

An attacker gains unauthorized access to an AWS account, potentially through compromised credentials or a vulnerability.
The attacker identifies an SNS topic containing sensitive data or acting as a conduit for valuable information.
The attacker uses the AWS CLI or API to subscribe to the targeted SNS topic.
The attacker selects a rare or unusual protocol for the subscription, such as an external email address, an HTTP endpoint on a rogue server, or a Lambda function under their control.
The attacker configures the subscription to forward messages from the SNS topic to the chosen endpoint.
When messages are published to the SNS topic, they are automatically delivered to the attacker-controlled endpoint.
The attacker receives the exfiltrated data via the chosen protocol.
The attacker covers their tracks by deleting CloudTrail logs or creating new subscriptions and deleting the original.

Impact

A successful attack can lead to the exfiltration of sensitive data, unauthorized access to internal systems, or resource hijacking within the AWS environment. The severity depends on the sensitivity of the data transmitted through the SNS topic and the permissions associated with the compromised AWS account. This could result in financial loss, reputational damage, or legal repercussions.

Recommendation

Deploy the "AWS SNS Rare Protocol Subscription by User" rule to your SIEM and tune the history_window_start to reduce false positives based on your environment.
Investigate any alerts generated by the "AWS SNS Rare Protocol Subscription by User" rule, focusing on the aws.cloudtrail.user_identity.arn and aws.cloudtrail.request_parameters fields to determine the actor and the protocol used.
Review IAM policies associated with users who trigger this alert to ensure the principle of least privilege.
Monitor CloudTrail logs for subsequent Publish actions on the same SNS topic to detect potential data exfiltration attempts.
Configure alerts for any unauthorized modifications to SNS topic policies or subscriptions.

AWS SNS Topic Message Publish by Rare User

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This detection rule identifies when a user or role publishes a message to an Amazon Simple Notification Service (SNS) topic for the first time. Attackers may abuse SNS topics for various malicious purposes, including internal spearphishing, data exfiltration, or lateral movement within the AWS environment. SNS topics are used to send notifications and messages to subscribed endpoints such as applications, mobile devices, or email addresses. A successful attack could lead to sensitive data being exposed or malicious content being distributed to a wide range of recipients. This rule leverages a "new terms" approach, focusing on identifying previously unseen behavior to surface potentially suspicious activity. It helps security teams detect unusual SNS activity and investigate potential security breaches in AWS environments.

Attack Chain

An attacker gains initial access to an AWS environment, potentially through compromised credentials or exploiting a misconfigured IAM role.
The attacker discovers accessible SNS topics within the AWS environment using AWS CLI or SDKs.
The attacker identifies an SNS topic with a broad subscription base, such as one connected to an internal communications channel.
The attacker publishes a malicious message to the SNS topic using the AWS CLI, SDK, or AWS Management Console, utilizing a rare or new user account.
The SNS service delivers the message to all subscribed endpoints, including applications, mobile devices, or email addresses.
Recipients of the malicious message may be tricked into clicking on a phishing link or downloading malicious content, leading to further compromise of their systems.
The attacker may leverage the compromised systems for lateral movement, data exfiltration, or other malicious activities.
The attacker achieves impact by spreading malware, stealing sensitive information, or disrupting business operations through the compromised systems and data.

Impact

A successful attack exploiting SNS topics can lead to several negative consequences. Internal spearphishing attacks could compromise employees and sensitive data. Data exfiltration through SNS messages may lead to regulatory violations and reputational damage. Resource hijacking could allow attackers to leverage AWS resources for malicious purposes, increasing costs and potentially disrupting services. Organizations in any sector that rely on AWS for their infrastructure are vulnerable, and the number of potential victims depends on the scope and reach of the SNS topic subscriptions.

Recommendation

Enable AWS CloudTrail logging for SNS data events to ensure the necessary logs are captured (reference: setup section).
Deploy the provided Sigma rule to your SIEM to detect rare users publishing SNS messages (reference: rules section). Tune the history_window_start parameter in the rule to match your environment's baseline.
Investigate any alerts generated by the Sigma rule, focusing on the aws.cloudtrail.user_identity.arn and aws.cloudtrail.resources.arn to identify the actor and SNS topic involved (reference: rule.investigation_fields).
Review IAM policies associated with users and roles publishing to SNS topics to ensure appropriate permissions are enforced and minimize potential misuse (reference: T1534, T1496).
Monitor for unusual API calls related to SNS, such as AssumeRole or CreateAccessKey, associated with the rare user (reference: T1102).

AWS SNS Topic Created by Rare User

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

This detection identifies when an AWS Simple Notification Service (SNS) topic is created by a user or role that doesn't typically perform this action. Adversaries might create SNS topics to stage capabilities for data exfiltration, lateral movement, or other malicious activities within the AWS environment. This detection leverages a "New Terms" rule, specifically designed to flag the initial occurrence of this behavior for a given user or role within an AWS account. The rule focuses on identifying anomalous SNS topic creation events, providing an early warning signal for potentially malicious activity related to resource development within AWS. It is triggered by the CreateTopic event in AWS CloudTrail logs, ensuring comprehensive coverage of SNS topic creation attempts.

Attack Chain

An attacker gains initial access to an AWS account, potentially through compromised credentials or an exposed IAM role. (T1566)
The attacker attempts to create a new SNS topic using the AWS CLI, SDK, or Console. The CreateTopic API call is made.
The CreateTopic request includes parameters such as the topic name, display name, and other attributes related to the SNS topic configuration.
AWS CloudTrail logs the CreateTopic event, capturing details such as the user identity (ARN, type, access key ID), source IP, user agent, and request parameters.
The "New Terms" rule analyzes the CloudTrail logs and identifies that the user or role creating the SNS topic has not previously performed this action within the observed timeframe.
The newly created SNS topic can be used by the attacker to subscribe to events and receive notifications about activities within the AWS environment. (T1496)
The attacker can then configure the SNS topic to trigger Lambda functions or S3 events, which allows persistence in the environment.
Ultimately, the adversary may use the SNS topic for data exfiltration, lateral movement, or other malicious purposes, leveraging the messaging capabilities of SNS.

Impact

Successful exploitation allows attackers to stage capabilities within the AWS environment. While creating an SNS topic is not inherently malicious, it can be a precursor to more serious attacks. Depending on the subsequent actions taken by the attacker, this could lead to data exfiltration, resource hijacking, or other forms of impact within the AWS infrastructure. The severity depends on the scope of access available to the compromised user or role and the configurations of the newly created SNS topic.

Recommendation

Deploy the Sigma rule provided in this brief to your SIEM and tune for your environment to detect unusual SNS topic creation activities (see rule: "AWS SNS Topic Created by Rare User").
Investigate any alerts generated by the Sigma rule, focusing on the user identity, source IP, and request parameters associated with the SNS topic creation event.
Monitor for further SNS modifications, such as Publish or Subscribe events, following the initial topic creation event (see Overview).
Enforce least privilege IAM policies and enable multi-factor authentication (MFA) to reduce the risk of unauthorized access to AWS resources (see Overview).