AWS Route Table Created

 1[metadata]
 2creation_date = "2021/06/05"
 3integration = ["aws"]
 4maturity = "production"
 5updated_date = "2025/01/15"
 6
 7[rule]
 8author = ["Elastic", "Austin Songer"]
 9description = "Identifies when an AWS Route Table has been created."
10false_positives = [
11    """
12    Route Tables may be created by a system or network administrators. Verify whether the user identity, user agent,
13    and/or hostname should be making changes in your environment. Route Table creation by unfamiliar users or hosts
14    should be investigated. If known behavior is causing false positives, it can be exempted from the rule. Automated
15    processes that use Terraform may lead to false positives.
16    """,
17]
18from = "now-60m"
19index = ["filebeat-*", "logs-aws.cloudtrail-*"]
20interval = "10m"
21language = "kuery"
22license = "Elastic License v2"
23name = "AWS Route Table Created"
24note = """## Triage and analysis
25
26> **Disclaimer**:
27> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
28
29### Investigating AWS Route Table Created
30
31AWS Route Tables are crucial components in managing network traffic within AWS environments, directing data between subnets and internet gateways. Adversaries may exploit route tables to reroute traffic for data exfiltration or to establish persistence by creating unauthorized routes. The detection rule monitors successful creation events of route tables, flagging potential misuse by correlating specific AWS CloudTrail logs, thus aiding in identifying unauthorized network configuration changes.
32
33### Possible investigation steps
34
35- Review the AWS CloudTrail logs for the specific event.provider:ec2.amazonaws.com and event.action values (CreateRoute or CreateRouteTable) to identify the user or role that initiated the route table creation.
36- Check the event.outcome:success field to confirm the successful creation of the route table and gather additional context such as timestamps and source IP addresses.
37- Investigate the associated AWS account and IAM user or role to determine if the action aligns with expected behavior and permissions.
38- Examine the newly created route table's configuration to identify any unauthorized or suspicious routes that could indicate potential misuse or data exfiltration attempts.
39- Correlate the event with other network security monitoring data to identify any unusual traffic patterns or anomalies that coincide with the route table creation.
40- Assess the environment for any recent changes or incidents that might explain the creation of the route table, such as new deployments or infrastructure modifications.
41
42### False positive analysis
43
44- Routine infrastructure updates or deployments may trigger route table creation events. To manage this, establish a baseline of expected behavior during scheduled maintenance windows and exclude these from alerts.
45- Automated cloud management tools often create route tables as part of their operations. Identify these tools and create exceptions for their known activities to reduce noise.
46- Development and testing environments frequently undergo changes, including the creation of route tables. Consider excluding these environments from alerts or applying a different set of monitoring rules.
47- Legitimate changes by authorized personnel can be mistaken for suspicious activity. Implement a process to verify and document authorized changes, allowing for quick exclusion of these events from alerts.
48- Multi-account AWS setups might have centralized networking teams that create route tables across accounts. Coordinate with these teams to understand their activities and exclude them from triggering alerts.
49
50### Response and remediation
51
52- Immediately isolate the affected AWS account or VPC to prevent further unauthorized network changes and potential data exfiltration.
53- Review the newly created route table and any associated routes to identify unauthorized entries. Remove any routes that are not part of the expected network configuration.
54- Conduct a thorough audit of IAM roles and permissions to ensure that only authorized users have the ability to create or modify route tables. Revoke any excessive permissions identified.
55- Implement network monitoring to detect unusual traffic patterns that may indicate data exfiltration or other malicious activities.
56- Escalate the incident to the security operations team for further investigation and to determine if additional AWS resources have been compromised.
57- Review AWS CloudTrail logs for any other suspicious activities around the time of the route table creation to identify potential indicators of compromise.
58- Update security policies and procedures to include specific guidelines for monitoring and responding to unauthorized route table modifications, ensuring rapid detection and response in the future.
59
60## Setup
61
62The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
63references = [
64    "https://docs.datadoghq.com/security_platform/default_rules/aws-ec2-route-table-modified/",
65    "https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateRoute.html",
66    "https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateRouteTable",
67]
68risk_score = 21
69rule_id = "e12c0318-99b1-44f2-830c-3a38a43207ca"
70severity = "low"
71tags = [
72    "Domain: Cloud",
73    "Data Source: AWS",
74    "Data Source: Amazon Web Services",
75    "Data Source: AWS Route53",
76    "Use Case: Network Security Monitoring",
77    "Tactic: Persistence",
78    "Resources: Investigation Guide",
79]
80timestamp_override = "event.ingested"
81type = "query"
82
83query = '''
84event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and event.action:(CreateRoute or CreateRouteTable) and
85event.outcome:success
86'''
87
88
89[[rule.threat]]
90framework = "MITRE ATT&CK"
91
92[rule.threat.tactic]
93id = "TA0003"
94name = "Persistence"
95reference = "https://attack.mitre.org/tactics/TA0003/"