AWS Backup Resource Enumeration via Long-Term Access Key

  1[metadata]
  2creation_date = "2026/08/24"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/08/24"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects enumeration of AWS Backup resources using long-term IAM access keys (AKIA* prefix).
 11AWS Backup protects EC2 instances, EBS volumes, RDS databases, DynamoDB tables, EFS file
 12systems, and S3 buckets. An adversary who obtains long-term access keys may enumerate backup
 13vaults, backup plans, and protected resources as a precursor to ransomware. Identifying which
 14resources have recent backups (indicating high-value data) and what vault access policies can
 15be modified to delete or corrupt the backups before encrypting the primary data.
 16"""
 17false_positives = [
 18    """
 19    Automated monitoring tools or compliance audit scripts using long-term IAM keys to
 20    inventory backup coverage will trigger this rule. Migrate automation to IAM roles with
 21    short-lived credentials. Long-term key usage for backup management is a security anti-pattern.
 22    """,
 23]
 24from = "now-6m"
 25index = ["logs-aws.cloudtrail-*"]
 26language = "kuery"
 27license = "Elastic License v2"
 28name = "AWS Backup Resource Enumeration via Long-Term Access Key"
 29note = """## Triage and analysis
 30
 31### Investigating AWS Backup Resource Enumeration via Long-Term Access Key
 32
 33AWS Backup vaults and plans are the last line of recovery for ransomware victims. Adversaries performing ransomware preparation systematically enumerate backup vaults to locate recovery points, assess vault lock configuration, and identify which vaults can be deleted or which backup plans can be disabled before encrypting the primary data stores.
 34
 35Long-term access keys (AKIA* prefix) are the most commonly exfiltrated credential type, appearing in source code, .env files, and CI/CD configurations. Their use for backup enumeration is particularly suspicious because backup management is almost never performed by individual IAM users with static keys in modern environments.
 36
 37### Possible investigation steps
 38
 39- Identify the IAM user from aws.cloudtrail.user_identity.arn and confirm whether this user should have backup management access.
 40- Review source.ip and source.as.organization.name against known infrastructure. Backup enumeration from an unexpected IP with a long-term key is a high-risk indicator.
 41- Query for subsequent backup write operations by this key: DeleteBackupVault, DeleteRecoveryPoint, DeleteBackupPlan, UpdateRegionSettings.
 42- Correlate with other enumeration activity from the same access key: EC2 Describe calls, S3 ListBuckets, RDS DescribeDBInstances — broad enumeration suggests ransomware reconnaissance.
 43- Determine whether Vault Lock is enabled on critical backup vaults (GetBackupVaultLockConfiguration).
 44
 45### Response and remediation
 46
 47- Immediately deactivate the long-term access key.
 48- Enable Vault Lock (WORM) on critical backup vaults to prevent deletion for a compliance period.
 49- Review all backup vault access policies for unauthorized modifications.
 50- Enable AWS Backup audit manager reports to detect future unauthorized backup modifications.
 51"""
 52references = [
 53    "https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListBackupVaults.html",
 54    "https://hackingthe.cloud/aws/enumeration/enumerate_services_via_aws_backup/",
 55]
 56risk_score = 21
 57rule_id = "e71ae602-bf44-4834-a4ea-b5c87047d426"
 58setup = "The AWS integration must be ingesting management events into `logs-aws.cloudtrail-*`. AWS Backup management events are logged by default."
 59severity = "low"
 60tags = [
 61    "Domain: Cloud",
 62    "Platform: AWS",
 63    "Data Source: AWS CloudTrail",
 64    "Service: AWS Backup",
 65    "Rule Type: Custom Query (KQL)",
 66    "Tactic: Discovery",
 67    "Resources: Investigation Guide",
 68]
 69timestamp_override = "event.ingested"
 70type = "query"
 71
 72query = '''
 73data_stream.dataset: "aws.cloudtrail"
 74    and event.provider: "backup.amazonaws.com"
 75    and event.action: (
 76        "ListBackupVaults" or
 77        "ListBackupJobs" or
 78        "ListBackupPlans" or
 79        "ListProtectedResources" or
 80        "ListRecoveryPointsByBackupVault" or
 81        "GetBackupPlan" or
 82        "GetBackupVaultAccessPolicy" or
 83        "DescribeBackupJob" or
 84        "DescribeRecoveryPoint"
 85    )
 86    and event.outcome: "success"
 87    and aws.cloudtrail.user_identity.access_key_id: AKIA*
 88'''
 89
 90
 91[[rule.threat]]
 92framework = "MITRE ATT&CK"
 93[[rule.threat.technique]]
 94id = "T1526"
 95name = "Cloud Service Discovery"
 96reference = "https://attack.mitre.org/techniques/T1526/"
 97
 98
 99[rule.threat.tactic]
100id = "TA0007"
101name = "Discovery"
102reference = "https://attack.mitre.org/tactics/TA0007/"
103
104[rule.investigation_fields]
105field_names = [
106    "@timestamp",
107    "aws.cloudtrail.user_identity.arn",
108    "aws.cloudtrail.user_identity.type",
109    "aws.cloudtrail.user_identity.access_key_id",
110    "user.name",
111    "event.action",
112    "event.outcome",
113    "source.ip",
114    "source.as.organization.name",
115    "cloud.region",
116    "cloud.account.id",
117]