AWS SNS Topic Message Publish by Rare User

  1[metadata]
  2creation_date = "2025/01/07"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2025/09/09"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies when an SNS topic message is published by a rare user in AWS. Adversaries may publish messages to SNS topics
 11for phishing campaigns, data exfiltration, or lateral movement within the AWS environment. SNS topics are used to send
 12notifications and messages to subscribed endpoints such as applications, mobile devices or email addresses, making them a
 13valuable target for adversaries to distribute malicious content or exfiltrate sensitive data. This is a New Terms rule that only flags
 14when this behavior is observed for the first time by a user or role.
 15"""
 16false_positives = [
 17    """
 18    New users or roles may legitimately publish messages to SNS topics for authorized purposes. Ensure that the action
 19    is authorized before taking action.
 20    """,
 21]
 22from = "now-6m"
 23index = ["filebeat-*", "logs-aws.cloudtrail-*"]
 24language = "kuery"
 25license = "Elastic License v2"
 26name = "AWS SNS Topic Message Publish by Rare User"
 27note = """## Triage and Analysis
 28
 29### Investigating AWS SNS Topic Message Publish by Rare User
 30
 31This rule identifies when a message is published to an SNS topic by a user who has rarely or never published messages before. This activity could indicate adversarial actions, such as using SNS topics for phishing campaigns, data exfiltration, or lateral movement within an AWS environment.
 32
 33This is a [New Terms](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-new-terms-rule) rule that only flags when this behavior is observed for the first time by a user or role.
 34
 35#### Possible Investigation Steps
 36
 37- **Identify the Actor and Resource**:
 38  - **User Identity and Role**: Examine the `aws.cloudtrail.user_identity.arn` to identify the user or role responsible for publishing the SNS message. Verify whether this actor is authorized to publish messages to SNS topics.
 39  - **Access Key Details**: Review the `aws.cloudtrail.user_identity.access_key_id` to determine the access key used.
 40  - **SNS Topic ARN**: Analyze `aws.cloudtrail.resources.arn` to confirm whether the SNS topic is critical, sensitive, or used for authorized purposes.
 41
 42- **Evaluate the Context of the SNS Message**:
 43  - **Published Message Details**: AWS redacts the message content in CloudTrail logs, but you can view the message ID, subject, and other metadata. Investigate the message details for any indicators of malicious content.
 44  - **Message Recipients**: Investigate the subscriptions associated with the SNS topic to identify if messages were sent to unauthorized or unexpected recipients.
 45
 46- **Analyze Source Information**:
 47  - **Source IP Address**: Examine the `source.ip` field to identify the origin of the activity. Unusual IP addresses or geolocations may indicate unauthorized access.
 48  - **User Agent**: Review `user_agent.original` to determine the tool or client used for publishing the SNS message. Automated tools or unexpected clients (e.g., `Boto3` from an unknown host) may signify misuse.
 49
 50- **Review Historical Activity**:
 51  - **Actor’s Past Behavior**: Identify whether the user has published messages to SNS topics before. Review similar past events for context.
 52  - **Frequency and Patterns**: Examine the time and frequency of messages published by the same user or to the same SNS topic to detect anomalies.
 53
 54- **Correlate with Other Events**:
 55  - **IAM or CloudTrail Events**: Look for events such as `AssumeRole`, `CreateAccessKey`, or other API actions associated with the same user ARN.
 56  - **Unusual IAM Role Activity**: Determine if the actor has assumed roles or performed administrative tasks atypical for their role.
 57
 58### False Positive Analysis
 59
 60- **Routine Operational Use**:
 61  - Confirm if the publishing activity aligns with standard operational tasks or automation scripts.
 62  - Validate whether new or rare users were recently granted permissions for publishing messages to SNS topics.
 63
 64- **Testing or Monitoring Scripts**:
 65  - Automated testing or monitoring tools may trigger this rule if configured to publish messages to SNS topics.
 66
 67### Response and Remediation
 68
 69- **Immediate Action**:
 70  - If unauthorized activity is confirmed, disable the access key or IAM role associated with the user.
 71  - Restrict or remove permissions from the SNS topic to prevent further misuse.
 72
 73- **Review Policies and Subscriptions**:
 74  - Audit the IAM policies tied to the user and SNS topic to ensure appropriate permissions.
 75  - Validate the subscriptions of the SNS topic to confirm all endpoints are authorized.
 76
 77- **Enhance Monitoring and Alerting**:
 78  - Set up additional logging or alerting for SNS publish actions, especially from rare or unknown users.
 79  - Monitor for similar actions across other SNS topics within the environment.
 80
 81- **Conduct a Root Cause Analysis**:
 82  - Investigate how the user or role gained access to publish messages to the SNS topic.
 83  - Determine if other AWS resources or services have been affected.
 84
 85### Additional Information
 86
 87For more information on SNS topic management and securing AWS resources, refer to:
 88- [AWS SNS Publish API Documentation](https://docs.aws.amazon.com/sns/latest/api/API_Publish.html)
 89- [AWS CloudTrail Documentation](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference.html)
 90"""
 91references = [
 92    "https://docs.aws.amazon.com/sns/latest/api/API_Publish.html",
 93    "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/",
 94    "https://permiso.io/blog/s/smishing-attack-on-aws-sms-new-phone-who-dis/",
 95    "https://www.sentinelone.com/labs/sns-sender-active-campaigns-unleash-messaging-spam-through-the-cloud/",
 96]
 97risk_score = 47
 98rule_id = "2112ecce-cd34-11ef-873f-f661ea17fbcd"
 99setup = "AWS SNS topic data event types need to be enabled in the CloudTrail trail configuration to capture the Publish action. Ensure that the AWS CloudTrail service is [configured](https://docs.aws.amazon.com/sns/latest/dg/logging-using-cloudtrail.html#cloudtrail-data-events) to log data events for SNS."
100severity = "medium"
101tags = [
102    "Domain: Cloud",
103    "Data Source: AWS",
104    "Data Source: Amazon Web Services",
105    "Data Source: AWS SNS",
106    "Use Case: Threat Detection",
107    "Resources: Investigation Guide",
108    "Tactic: Lateral Movement",
109    "Tactic: Exfiltration",
110    "Tactic: Impact",
111]
112timestamp_override = "event.ingested"
113type = "new_terms"
114
115query = '''
116event.dataset:"aws.cloudtrail"
117    and event.provider:"sns.amazonaws.com"
118    and event.action:"Publish"
119    and event.outcome:"success"
120'''
121
122[rule.investigation_fields]
123field_names = [
124    "@timestamp",
125    "user.name",
126    "user_agent.original",
127    "source.ip",
128    "aws.cloudtrail.user_identity.arn",
129    "aws.cloudtrail.user_identity.type",
130    "aws.cloudtrail.user_identity.access_key_id",
131    "aws.cloudtrail.resources.arn",     
132    "aws.cloudtrail.resources.type",   
133    "event.action",
134    "event.outcome",
135    "cloud.account.id",
136    "cloud.region",
137    "aws.cloudtrail.request_parameters",
138    "aws.cloudtrail.response_elements"
139]
140
141[[rule.threat]]
142framework = "MITRE ATT&CK"
143[[rule.threat.technique]]
144id = "T1534"
145name = "Internal Spearphishing"
146reference = "https://attack.mitre.org/techniques/T1534/"
147
148
149[rule.threat.tactic]
150id = "TA0008"
151name = "Lateral Movement"
152reference = "https://attack.mitre.org/tactics/TA0008/"
153[[rule.threat]]
154framework = "MITRE ATT&CK"
155[[rule.threat.technique]]
156id = "T1567"
157name = "Exfiltration Over Web Service"
158reference = "https://attack.mitre.org/techniques/T1567/"
159
160
161[rule.threat.tactic]
162id = "TA0010"
163name = "Exfiltration"
164reference = "https://attack.mitre.org/tactics/TA0010/"
165[[rule.threat]]
166framework = "MITRE ATT&CK"
167[[rule.threat.technique]]
168id = "T1496"
169name = "Resource Hijacking"
170reference = "https://attack.mitre.org/techniques/T1496/"
171[[rule.threat.technique.subtechnique]]
172id = "T1496.004"
173name = "Cloud Service Hijacking"
174reference = "https://attack.mitre.org/techniques/T1496/004/"
175
176
177
178[rule.threat.tactic]
179id = "TA0040"
180name = "Impact"
181reference = "https://attack.mitre.org/tactics/TA0040/"
182
183[rule.new_terms]
184field = "new_terms_fields"
185value = ["cloud.account.id", "user.name", "aws.cloudtrail.resources.arn"]
186[[rule.new_terms.history_window_start]]
187field = "history_window_start"
188value = "now-10d"