AWS Potential Cryptomining via ECS Task Definition Deployment

  1[metadata]
  2creation_date = "2026/07/08"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/07/08"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies a principal that, within a short window, both registers an Amazon ECS task definition using a public / non-ECR
 11container image at a high CPU allocation (8 or 16 vCPU) AND launches ECS workloads (RunTask, StartTask, or CreateService).
 12Registering a public miner image at maximum compute and then launching it is the ECS/Fargate cryptocurrency-mining
 13deployment pattern seen after credential compromise. Requiring both the mining-signature registration and a launch by the
 14same principal confirms an actual deployment rather than a standalone (possibly benign) task-definition registration,
 15which sharply reduces false positives from high-compute workloads that are merely registered.
 16"""
 17false_positives = [
 18    """
 19    A principal that legitimately both registers a high-compute public-image task definition and runs ECS workloads in the
 20    same window could match (for example, some data-science or batch pipelines). Confirm the image and CPU in
 21    "aws.cloudtrail.request_parameters" of the RegisterTaskDefinition event, the launched workload, and whether the
 22    principal in "aws.cloudtrail.user_identity.arn" is an expected ECS operator; exclude known principals after validation.
 23    The CPU threshold and registry list are tunable in the query.
 24    """,
 25]
 26from = "now-30m"
 27language = "esql"
 28license = "Elastic License v2"
 29name = "AWS Potential Cryptomining via ECS Task Definition Deployment"
 30note = """## Triage and analysis
 31
 32### Investigating AWS Potential Cryptomining via ECS Task Definition Deployment
 33
 34Amazon ECS runs containers from images referenced in a task definition. After credential compromise, a common impact action is to abuse ECS/Fargate for cryptomining: the adversary registers a task definition pointing at a public miner image (Docker Hub, GHCR, Quay, or the public ECR gallery) at maximum CPU to maximize hashrate, then launches it at scale via RunTask/CreateService, often across multiple regions.
 35
 36This rule correlates by principal within the rule window and fires only when the same identity BOTH (a) registers a task definition whose container image comes from a public registry and whose CPU is high (8-16 vCPU), AND (b) launches ECS workloads (RunTask/StartTask/CreateService). Requiring the launch in addition to the mining-signature registration confirms active deployment and distinguishes it from a task definition that is merely registered.
 37
 38### Possible investigation steps
 39
 40- Review the RegisterTaskDefinition event's "aws.cloudtrail.request_parameters" for the container image, CPU/memory, and task family, and the launch event(s) for the cluster and desired count.
 41- Identify the principal in "aws.cloudtrail.user_identity.arn"/"aws.cloudtrail.user_identity.type" and whether it normally operates ECS; review "source.ip"/"source.as.number" and "user_agent.original".
 42- Correlate with related activity by the same principal: ECS "CreateCluster" (especially in unused regions), new IAM users with administrative policies, and prior reconnaissance.
 43- Inspect the referenced image and any running containers/tasks and their outbound network connections (mining-pool traffic).
 44
 45### False positive analysis
 46
 47- Legitimate batch/data-science workloads may both register a high-compute public-image task definition and run it. Validate the image, workload, and principal, and exclude known-good identities after confirmation.
 48
 49### Response and remediation
 50
 51- If unauthorized, stop and delete the launched services/tasks, deregister the task definition, and review other regions for the same activity.
 52- Investigate the principal for compromise, revoke or rotate its credentials, and review for persistence (new IAM users/policies).
 53- Restrict ECS task-definition registration and task execution roles, and require images from approved private ECR repositories.
 54"""
 55references = [
 56    "https://securitylabs.datadoghq.com/articles/tales-from-the-cloud-trenches-ecs-crypto-mining/",
 57    "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definitions.html",
 58]
 59risk_score = 73
 60rule_id = "3ca27e45-b0cd-417a-914c-d086869acd1b"
 61setup = "This rule requires AWS CloudTrail logs ingested via the Elastic AWS integration. See https://docs.elastic.co/integrations/aws/cloudtrail for setup details."
 62severity = "high"
 63tags = [
 64    "Domain: Cloud",
 65    "Data Source: AWS",
 66    "Data Source: AWS CloudTrail",
 67    "Data Source: Amazon Web Services",
 68    "Use Case: Threat Detection",
 69    "Tactic: Impact",
 70    "Resources: Investigation Guide",
 71]
 72timestamp_override = "event.ingested"
 73type = "esql"
 74
 75query = '''
 76FROM logs-aws.cloudtrail-*
 77| WHERE event.provider == "ecs.amazonaws.com"
 78    AND event.action IN ("RegisterTaskDefinition", "RunTask", "StartTask", "CreateService")
 79| EVAL Esql.miner_register = CASE(
 80        event.action == "RegisterTaskDefinition"
 81            AND (aws.cloudtrail.request_parameters RLIKE """.*image=(docker.io|index.docker.io|ghcr.io|quay.io|public.ecr.aws)/.*"""
 82                OR aws.cloudtrail.request_parameters RLIKE """.*image=[-a-zA-Z0-9_]+(/|[,} :]).*""")
 83            AND aws.cloudtrail.request_parameters RLIKE """.*cpu=(8192|16384)[,} ].*""", 1, 0),
 84    Esql.task_run = CASE(event.action IN ("RunTask", "StartTask", "CreateService"), 1, 0)
 85| STATS Esql.miner_register_sum = SUM(Esql.miner_register), Esql.task_run_sum = SUM(Esql.task_run), Esql.event_count = COUNT(*),
 86        Esql.cloud_region_count_distinct = COUNT_DISTINCT(cloud.region), Esql.cloud_region_values = VALUES(cloud.region),
 87        Esql.event_action_values = VALUES(event.action), Esql.source_ip_values = VALUES(source.ip),
 88        Esql.source_as_number_values = VALUES(source.as.number), Esql.user_agent_original_values = VALUES(user_agent.original),
 89        Esql.cloud_account_id_values = VALUES(cloud.account.id), Esql.aws_cloudtrail_user_identity_type_values = VALUES(aws.cloudtrail.user_identity.type),
 90        Esql.timestamp_min = MIN(@timestamp), Esql.timestamp_max = MAX(@timestamp)
 91        BY aws.cloudtrail.user_identity.arn
 92| WHERE Esql.miner_register_sum >= 1 AND Esql.task_run_sum >= 1
 93| KEEP aws.*, Esql.aws_cloudtrail_user_identity_type_values, Esql.miner_register_sum, Esql.task_run_sum, Esql.event_count, Esql.cloud_region_count_distinct, Esql.cloud_region_values, Esql.event_action_values, Esql.source_ip_values, Esql.source_as_number_values, Esql.user_agent_original_values, Esql.cloud_account_id_values, Esql.timestamp_min, Esql.timestamp_max
 94'''
 95
 96[rule.investigation_fields]
 97field_names = [
 98    "aws.cloudtrail.user_identity.arn",
 99    "Esql.aws_cloudtrail_user_identity_type_values",
100    "Esql.miner_register_sum",
101    "Esql.task_run_sum",
102    "Esql.event_count",
103    "Esql.cloud_region_count_distinct",
104    "Esql.cloud_region_values",
105    "Esql.event_action_values",
106    "Esql.source_ip_values",
107    "Esql.source_as_number_values",
108    "Esql.user_agent_original_values",
109    "Esql.cloud_account_id_values",
110    "Esql.timestamp_min",
111    "Esql.timestamp_max",
112]
113
114
115[[rule.threat]]
116framework = "MITRE ATT&CK"
117[[rule.threat.technique]]
118id = "T1496"
119name = "Resource Hijacking"
120reference = "https://attack.mitre.org/techniques/T1496/"
121
122[rule.threat.tactic]
123id = "TA0040"
124name = "Impact"
125reference = "https://attack.mitre.org/tactics/TA0040/"