AWS EC2 Instance Console Login via Assumed Role

 1[metadata]
 2creation_date = "2024/07/24"
 3integration = ["aws"]
 4maturity = "production"
 5updated_date = "2024/07/31"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Identifies a successful console login activity by an EC2 instance profile using an assumed role. This is uncommon behavior and could indicate an attacker using compromised credentials to further exploit an environment. An EC2 instance assumes a role using their EC2 ID as the session name. This rule looks for the pattern "i-" which is the beginning pattern for assumed role sessions started by an EC2 instance and a successful `ConsoleLogin` or `GetSigninToken` API call.
11"""
12false_positives = ["This is very uncommon behavior and should result in minimal false positives, ensure validity of the triggered event and include exceptions where necessary."]
13from = "now-6m"
14index = ["filebeat-*", "logs-aws.cloudtrail-*"]
15language = "eql"
16license = "Elastic License v2"
17name = "AWS EC2 Instance Console Login via Assumed Role"
18references = [
19    "https://redcanary.com/blog/aws-sts/",
20    "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-custom-url.html/",
21]
22risk_score = 73
23rule_id = "d1e5e410-3e34-412e-9b1f-dd500b3b55cd"
24severity = "high"
25tags = [
26    "Domain: Cloud",
27    "Data Source: AWS",
28    "Data Source: Amazon Web Services",
29    "Data Source: AWS EC2",
30    "Data Source: AWS STS",
31    "Use Case: Identity and Access Audit",
32    "Tactic: Lateral Movement",
33    "Tactic: Credential Access",
34]
35timestamp_override = "event.ingested"
36type = "eql"
37
38query = '''
39any where event.dataset == "aws.cloudtrail"
40   and event.provider == "signin.amazonaws.com"
41   and event.action in ("ConsoleLogin", "GetSigninToken") 
42   and event.outcome == "success"
43   and aws.cloudtrail.user_identity.type == "AssumedRole"
44   and stringContains (user.id, ":i-")
45'''
46
47
48[[rule.threat]]
49framework = "MITRE ATT&CK"
50[[rule.threat.technique]]
51id = "T1021"
52name = "Remote Services"
53reference = "https://attack.mitre.org/techniques/T1021/"
54[[rule.threat.technique.subtechnique]]
55id = "T1021.007"
56name = "Cloud Services"
57reference = "https://attack.mitre.org/techniques/T1021/007/"
58
59[[rule.threat.technique]]
60id = "T1550"
61name = "Use Alternate Authentication Material"
62reference = "https://attack.mitre.org/techniques/T1550/"
63[[rule.threat.technique.subtechnique]]
64id = "T1550.001"
65name = "Application Access Token"
66reference = "https://attack.mitre.org/techniques/T1550/001/"
67
68
69[rule.threat.tactic]
70id = "TA0008"
71name = "Lateral Movement"
72reference = "https://attack.mitre.org/tactics/TA0008/"
73
74
75[[rule.threat]]
76framework = "MITRE ATT&CK"
77
78[rule.threat.tactic]
79id = "TA0006"
80name = "Credential Access"
81reference = "https://attack.mitre.org/tactics/TA0006/"