LoFP / new users or roles may legitimately publish messages to sns topics for authorized purposes. ensure that the action is authorized before taking action.

Techniques

• T1496
• T1534
• T1567

Sample rules

AWS SNS Topic Message Publish by Rare User

• source: elastic
• technicques:
  • T1496
  • T1534
  • T1567

Description

Identifies when an SNS topic message is published by a rare user in AWS. Adversaries may publish messages to SNS topics for phishing campaigns, data exfiltration, or lateral movement within the AWS environment. SNS topics are used to send notifications and messages to subscribed endpoints such as applications, mobile devices or email addresses, making them a valuable target for adversaries to distribute malicious content or exfiltrate sensitive data. This is a New Terms rule that only flags when this behavior is observed for the first time by a user or role.

Detection logic

event.dataset:"aws.cloudtrail"
    and event.provider:"sns.amazonaws.com"
    and event.action:"Publish"
    and event.outcome:"success"