AWS IAM Create User via Assumed Role on EC2 Instance

  1[metadata]
  2creation_date = "2024/11/04"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2025/09/04"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects the creation of an AWS Identity and Access Management (IAM) user initiated by an assumed role on an EC2
 11instance. Assumed roles allow users or services to temporarily adopt different AWS permissions, but the creation of IAM
 12users through these roles, particularly from within EC2 instances, may indicate a compromised instance. Adversaries might
 13exploit such permissions to establish persistence by creating new IAM users under unauthorized conditions.
 14"""
 15false_positives = [
 16    """
 17    Assumed roles may be used by legitimate automated systems to create IAM users for specific workflows. Verify if this
 18    event aligns with known automation activities. If the action is routine for specific roles or user agents (e.g.,
 19    `aws-cli`, `boto3`), consider adding those roles or user agents to a monitored exception list for streamlined
 20    review.
 21    """,
 22]
 23from = "now-6m"
 24index = ["filebeat-*", "logs-aws.cloudtrail-*"]
 25language = "kuery"
 26license = "Elastic License v2"
 27name = "AWS IAM Create User via Assumed Role on EC2 Instance"
 28note = """## Triage and analysis
 29
 30### Investigating AWS IAM Create User via Assumed Role on EC2 Instance
 31
 32This rule detects when an AWS Identity and Access Management (IAM) user is created through an assumed role on an EC2 instance. This action may indicate a potentially compromised instance where an adversary could be using the instance’s permissions to create a new IAM user, enabling persistent unauthorized access.
 33
 34#### Possible Investigation Steps
 35
 36- **Identify the Assumed Role and Initiating Instance**:
 37  - **Role and Instance**: Examine the `aws.cloudtrail.user_identity.arn` field to determine the specific EC2 instance and role used for this action (e.g., `arn:aws:sts::[account-id]:assumed-role/[role-name]/[instance-id]`). Verify if this behavior aligns with expected usage or represents an anomaly.
 38
 39- **Analyze the Target IAM User**:
 40  - **New User Details**: Inspect `aws.cloudtrail.request_parameters` to see the username that was created. Validate if the user is expected or authorized.
 41  - **Review Creation Time and Context**: Compare the creation time (`@timestamp`) of the user with other activities from the same instance and role to assess if this creation was part of a larger chain of actions.
 42
 43- **Check User Agent and Tooling**:
 44  - **User Agent Analysis**: Review `user_agent.original` to see if AWS CLI, SDK, or other tooling was used for this request. Identifiers such as `aws-cli`, `boto3`, or similar SDK names can indicate the method used, which may differentiate automation from interactive actions.
 45  - **Source IP and Location**: Use the `source.ip` and `source.geo` fields to identify the IP address and geographic location of the event. Verify if this aligns with expected access patterns for your environment.
 46
 47- **Evaluate for Persistence Indicators**:
 48  - **Role Permissions**: Check the permissions associated with the assumed role (`arn:aws:iam::[account-id]:role/[role-name]`) to determine if creating IAM users is a legitimate activity for this role.
 49  - **Automated Role Patterns**: If the assumed role or instance typically creates IAM users for automation purposes, validate this action against historical records to confirm if the event is consistent with normal patterns.
 50
 51- **Review Related CloudTrail Events**:
 52  - **Additional IAM Actions**: Investigate for other recent IAM or CloudTrail events tied to this role or instance, especially `CreateAccessKey` or `AttachUserPolicy` actions. These could signal further attempts to empower or utilize the newly created user.
 53  - **Correlate with Other Suspicious Activities**: Determine if other roles or instances recently initiated similar unusual actions, such as privilege escalations or data access.
 54
 55### False Positive Analysis
 56
 57- **Expected Automation**: Assumed roles may be used by legitimate automated systems that create users for specific workflows. Confirm if this event aligns with known automation activities.
 58- **Role Exceptions**: If this action is routine for specific roles, consider adding those roles to a monitored exception list for streamlined review.
 59
 60### Response and Remediation
 61
 62- **Immediate Access Review**: If user creation was unauthorized, restrict the assumed role’s permissions to prevent further user creation.
 63- **Delete Unauthorized Users**: Confirm and remove any unauthorized IAM users, adjusting IAM policies to reduce similar risks.
 64- **Enhance Monitoring and Alerts**: Enable enhanced logging or real-time alerts for this role or instance to detect further unauthorized access attempts.
 65- **Policy Update**: Consider updating IAM policies associated with roles on EC2 instances to limit sensitive actions like IAM user creation.
 66
 67### Additional Information
 68
 69For further guidance on managing IAM roles and permissions within AWS environments, refer to the [AWS IAM documentation](https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateUser.html) and AWS best practices for security.
 70"""
 71references = [
 72    "https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateUser.html",
 73    "https://www.dionach.com/en-us/breaking-into-the-cloud-red-team-tactics-for-aws-compromise/",
 74]
 75risk_score = 47
 76rule_id = "f7a1c536-9ac0-11ef-9911-f661ea17fbcd"
 77severity = "medium"
 78tags = [
 79    "Domain: Cloud",
 80    "Data Source: AWS",
 81    "Data Source: Amazon Web Services",
 82    "Data Source: AWS IAM",
 83    "Use Case: Identity and Access Audit",
 84    "Tactic: Persistence",
 85    "Resources: Investigation Guide",
 86]
 87timestamp_override = "event.ingested"
 88type = "new_terms"
 89
 90query = '''
 91event.dataset: "aws.cloudtrail"
 92    and event.provider: "iam.amazonaws.com"
 93    and event.action: "CreateUser"
 94    and event.outcome: "success"
 95    and aws.cloudtrail.user_identity.type: "AssumedRole"
 96    and user.id: *\:i-*
 97'''
 98
 99[rule.investigation_fields]
100field_names = [
101    "@timestamp",
102    "user.name",
103    "user_agent.original",
104    "source.ip",
105    "aws.cloudtrail.user_identity.arn",
106    "aws.cloudtrail.user_identity.type",
107    "aws.cloudtrail.user_identity.access_key_id",
108    "event.action",
109    "event.outcome",
110    "cloud.account.id",
111    "cloud.region",
112    "aws.cloudtrail.request_parameters",
113    "aws.cloudtrail.response_elements"
114]
115
116
117[[rule.threat]]
118framework = "MITRE ATT&CK"
119[[rule.threat.technique]]
120id = "T1136"
121name = "Create Account"
122reference = "https://attack.mitre.org/techniques/T1136/"
123[[rule.threat.technique.subtechnique]]
124id = "T1136.003"
125name = "Cloud Account"
126reference = "https://attack.mitre.org/techniques/T1136/003/"
127
128
129
130[rule.threat.tactic]
131id = "TA0003"
132name = "Persistence"
133reference = "https://attack.mitre.org/tactics/TA0003/"
134
135[rule.new_terms]
136field = "new_terms_fields"
137value = ["aws.cloudtrail.user_identity.arn"]
138[[rule.new_terms.history_window_start]]
139field = "history_window_start"
140value = "now-10d"