Techniques
Sample rules
AWS EC2 Snapshot Shared Externally
- source: splunk
- technicques:
- T1537
Description
The following analytic detects when an EC2 snapshot is shared with an external AWS account by analyzing AWS CloudTrail events. This detection method leverages CloudTrail logs to identify modifications in snapshot permissions, specifically when the snapshot is shared outside the originating AWS account. This activity is significant as it may indicate an attempt to exfiltrate sensitive data stored in the snapshot. If confirmed malicious, an attacker could gain unauthorized access to the snapshot’s data, potentially leading to data breaches or further exploitation of the compromised information.
Detection logic
`cloudtrail` eventName=ModifySnapshotAttribute
| rename requestParameters.createVolumePermission.add.items{}.userId as requested_account_id
| search requested_account_id != NULL
| eval match=if(requested_account_id==aws_account_id,"Match","No Match")
| table _time user_arn src_ip requestParameters.attributeType requested_account_id aws_account_id match vendor_region user_agent userIdentity.principalId
| where match = "No Match"
| `aws_ec2_snapshot_shared_externally_filter`
AWS AMI Attribute Modification for Exfiltration
- source: splunk
- technicques:
- T1537
Description
The following analytic detects suspicious modifications to AWS AMI attributes, such as sharing an AMI with another AWS account or making it publicly accessible. It leverages AWS CloudTrail logs to identify these changes by monitoring specific API calls. This activity is significant because adversaries can exploit these modifications to exfiltrate sensitive data stored in AWS resources. If confirmed malicious, this could lead to unauthorized access and potential data breaches, compromising the confidentiality and integrity of organizational information.
Detection logic
`cloudtrail` eventName=ModifyImageAttribute (requestParameters.launchPermission.add.items{}.userId = * OR requestParameters.launchPermission.add.items{}.group = all)
| rename requestParameters.launchPermission.add.items{}.group as group_added
| rename requestParameters.launchPermission.add.items{}.userId as accounts_added
| eval ami_status=if(match(group_added,"all") ,"Public AMI", "Not Public")
| stats count min(_time) as firstTime max(_time) as lastTime values(group_added) values(accounts_added) as accounts_added values(ami_status) by src_ip region eventName userAgent user_arn aws_account_id userIdentity.principalId
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `aws_ami_attribute_modification_for_exfiltration_filter`