AWS Suspicious User Agent Fingerprint

  1[metadata]
  2creation_date = "2025/04/11"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies successful AWS API calls where the CloudTrail user agent indicates offensive tooling or automated credential
 11verification. This includes the AWS CLI or Boto3 reporting a Kali Linux distribution fingerprint (`distrib#kali`), and
 12clients that identify as TruffleHog, which is commonly used to validate leaked secrets against live AWS APIs. These
 13patterns are uncommon for routine production workloads and may indicate compromised credentials, unauthorized access, or
 14security tooling operating outside approved scope.
 15"""
 16false_positives = [
 17    """
 18    Authorized penetration tests, red team exercises, or research activity may originate from Kali Linux. Internal
 19    secret scanning pipelines may run TruffleHog with permission to reach AWS for verification. Validate the IAM
 20    principal, source network, change records, and whether the activity matches documented security or DevSecOps
 21    workflows.
 22    """,
 23]
 24from = "now-6m"
 25index = ["logs-aws.cloudtrail-*"]
 26language = "eql"
 27license = "Elastic License v2"
 28name = "AWS Suspicious User Agent Fingerprint"
 29note = """## Triage and Analysis
 30
 31### Investigating AWS Suspicious User Agent Fingerprint
 32
 33AWS CloudTrail records the user agent string for API requests, which can reveal the OS distribution and client tooling.
 34Two high-signal patterns this rule covers are:
 35
 36- **Kali Linux fingerprint** — When the AWS CLI or Boto3 reports `distrib#kali`, the request likely came from a Kali
 37  environment. Kali is widely used for penetration testing and adversarial tradecraft, so this is worth correlating with
 38  identity, network context, and sensitivity of API actions.
 39- **TruffleHog** — TruffleHog identifies itself in the user agent when verifying whether recovered credentials are still
 40  valid. Observing it against your account may indicate leaked keys are being tested, including through supply-chain or
 41  secret-scanning abuse by a third party.
 42
 43This detection focuses on **successful** API activity. Evaluate who performed the action, what was accessed or modified,
 44and whether the source and tooling align with expectations.
 45
 46### Possible investigation steps
 47
 48**Identify the actor**
 49- Review `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.access_key_id` to determine which IAM
 50  principal was used.
 51- Check whether this principal normally uses CLI/SDK clients and whether Kali or TruffleHog is ever expected for their role.
 52
 53**Review access patterns and actions**
 54- Examine API calls associated with the matched user agent for high-risk activity such as IAM changes, data access,
 55  snapshot sharing, logging modification, or persistence-related actions.
 56- Look for sequences indicating initial access or expansion, such as `GetSessionToken`, `AssumeRole`, or privilege
 57  escalation attempts.
 58- Determine whether the activity scope aligns with the principal’s intended permissions and business function.
 59
 60**Inspect source network and tooling context**
 61- Review `source.ip`, `source.geo` fields, and ASN to determine whether the request originated from an expected corporate
 62  network, VPN, CI/CD egress, or known security testing infrastructure.
 63- Analyze `user_agent.original` to confirm which pattern matched (`distrib#kali` vs `TruffleHog`) and whether usage looks
 64  interactive, scripted, or scanner-driven.
 65- Sudden shifts from console-based access to CLI from an offensive distribution, or first-time TruffleHog against the
 66  account, may indicate credential compromise or unauthorized scanning.
 67
 68**Correlate with surrounding activity**
 69- Search for additional CloudTrail events tied to the same access key or session before and after this detection.
 70- Look for evidence of follow-on actions such as resource creation, configuration changes, or attempts to disable logging
 71  and monitoring services.
 72- Assess whether the activity represents a single isolated request or part of a broader behavioral chain.
 73
 74### False positive analysis
 75
 76- Internal red team or authorized assessments may produce Kali-based AWS CLI or SDK traffic. Confirm scope, timing, and
 77  authorization.
 78- Organizational use of TruffleHog in CI to validate rotated keys or scan artifacts may generate this signal; restrict
 79  exceptions to known roles, repositories, and egress IPs where possible.
 80
 81### Response and remediation
 82
 83- If the activity is unauthorized, immediately revoke or rotate the affected access keys or invalidate the active
 84  session.
 85- Review IAM permissions associated with the identity and reduce scope where possible to enforce least privilege.
 86- Investigate for additional indicators of compromise, including unusual role assumptions, new credential creation, or
 87  data access from the same identity.
 88- Notify security operations and incident response teams if the activity aligns with known adversary behaviors or appears
 89  part of a larger intrusion.
 90- Consider adding guardrails or conditional access controls (such as source IP restrictions or MFA enforcement) for
 91  sensitive IAM principals.
 92
 93### Additional information
 94- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)**
 95- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)**
 96- **[AWS Knowledge Center – Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/)**
 97"""
 98references = [
 99    "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-user-identity.html",
100    "https://www.sygnia.co/blog/sygnia-investigation-bybit-hack/",
101    "https://trufflesecurity.com/blog/trufflehog-in-your-logs",
102    "https://kudelskisecurity.com/research/investigating-two-variants-of-the-trivy-supply-chain-compromise",
103]
104risk_score = 73
105rule_id = "f80ea920-f6f5-4c8a-9761-84ac97ec0cb2"
106severity = "high"
107tags = [
108    "Domain: Cloud",
109    "Data Source: AWS",
110    "Data Source: Amazon Web Services",
111    "Platform: AWS",
112    "Data Source: AWS CloudTrail",
113    "Tactic: Initial Access",
114    "Rule Type: Event Correlation (EQL)",
115    "Resources: Investigation Guide",
116    "Noise: Medium",
117    "Performance: Fast",
118]
119timestamp_override = "event.ingested"
120type = "eql"
121
122query = '''
123any where data_stream.dataset == "aws.cloudtrail"
124  and event.outcome == "success"
125  and (
126    (
127      stringContains(user_agent.original, "distrib#kali")
128      or stringContains(user_agent.original, "+kali")
129      or stringContains(user_agent.original, "kali-amd64")
130      or stringContains(user_agent.original, "kali-arm64")
131    ) or (
132      stringContains(user_agent.original, "TruffleHog")
133      or stringContains(user_agent.original, "trufflehog")
134    )
135  )
136'''
137
138
139[[rule.threat]]
140framework = "MITRE ATT&CK"
141
142[[rule.threat.technique]]
143id = "T1078"
144name = "Valid Accounts"
145reference = "https://attack.mitre.org/techniques/T1078/"
146
147[[rule.threat.technique.subtechnique]]
148id = "T1078.004"
149name = "Cloud Accounts"
150reference = "https://attack.mitre.org/techniques/T1078/004/"
151
152[rule.threat.tactic]
153id = "TA0001"
154name = "Initial Access"
155reference = "https://attack.mitre.org/tactics/TA0001/"
156
157[[rule.threat]]
158framework = "MITRE ATT&CK"
159
160[[rule.threat.technique]]
161id = "T1078"
162name = "Valid Accounts"
163reference = "https://attack.mitre.org/techniques/T1078/"
164
165[[rule.threat.technique.subtechnique]]
166id = "T1078.004"
167name = "Cloud Accounts"
168reference = "https://attack.mitre.org/techniques/T1078/004/"
169
170[rule.threat.tactic]
171id = "TA0005"
172name = "Defense Evasion"
173reference = "https://attack.mitre.org/tactics/TA0005/"
174[rule.investigation_fields]
175field_names = [
176    "@timestamp",
177    "user.name",
178    "user_agent.original",
179    "source.ip",
180    "aws.cloudtrail.user_identity.arn",
181    "aws.cloudtrail.user_identity.type",
182    "aws.cloudtrail.user_identity.access_key_id",
183    "aws.cloudtrail.resources.arn",
184    "aws.cloudtrail.resources.type",
185    "event.action",
186    "event.outcome",
187    "cloud.account.id",
188    "cloud.region",
189    "aws.cloudtrail.request_parameters",
190    "aws.cloudtrail.response_elements"
191]