AWS EC2 Instance Connect SSH Public Key Uploaded
Identifies when a new SSH public key is uploaded to an AWS EC2 instance using the EC2 Instance Connect service. This
action could indicate an adversary attempting to maintain access to the instance. The rule also detects the
SendSerialConsoleSSHPublicKey
API action, which could be used for privilege escalation if the serial console is
enabled. Monitoring these activities helps ensure unauthorized access attempts are detected and mitigated promptly.
Elastic rule (View on GitHub)
1[metadata]
2creation_date = "2024/04/30"
3integration = ["aws"]
4maturity = "production"
5updated_date = "2024/07/23"
6
7[rule]
8author = ["Elastic"]
9description = """
10Identifies when a new SSH public key is uploaded to an AWS EC2 instance using the EC2 Instance Connect service. This
11action could indicate an adversary attempting to maintain access to the instance. The rule also detects the
12`SendSerialConsoleSSHPublicKey` API action, which could be used for privilege escalation if the serial console is
13enabled. Monitoring these activities helps ensure unauthorized access attempts are detected and mitigated promptly.
14"""
15false_positives = ["Administrators may upload SSH public keys to EC2 instances for legitimate purposes."]
16from = "now-9m"
17index = ["filebeat-*", "logs-aws.cloudtrail-*"]
18language = "kuery"
19license = "Elastic License v2"
20name = "AWS EC2 Instance Connect SSH Public Key Uploaded"
21note = """## Triage and Analysis
22
23### Investigating AWS EC2 Instance Connect SSH Public Key Uploaded
24
25This rule detects when a new SSH public key is uploaded to an AWS EC2 instance using the EC2 Instance Connect service. Adversaries may upload SSH public keys to EC2 instances to maintain access to the instance. The rule also covers cases where the `SendSerialConsoleSSHPublicKey` API action is used to upload an SSH public key to a serial connection, which can be exploited for privilege escalation.
26
27#### Possible Investigation Steps:
28
29- **Identify the Actor**: Review the `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.access_key_id` fields to identify who performed the action. Verify if this actor typically performs such actions and if they have the necessary permissions.
30- **Review the Request Details**: Examine the `aws.cloudtrail.request_parameters` to understand the specific details of the SSH public key upload. Look for any unusual parameters that could suggest unauthorized or malicious modifications.
31- **Analyze the Source of the Request**: Investigate the `source.ip` and `source.geo` fields to determine the geographical origin of the request. An external or unexpected location might indicate compromised credentials or unauthorized access.
32- **Contextualize with Timestamp**: Use the `@timestamp` field to check when the SSH public key was uploaded. Changes during non-business hours or outside regular maintenance windows might require further scrutiny.
33- **Correlate with Other Activities**: Search for related CloudTrail events before and after this action to see if the same actor or IP address engaged in other potentially suspicious activities.
34- **Check for Serial Console Access**: If the `SendSerialConsoleSSHPublicKey` action was used, verify if the `ec2:EnableSerialConsoleAccess` permission was also used, which might indicate an attempt to enable and exploit the serial console.
35
36### False Positive Analysis:
37
38- **Legitimate Administrative Actions**: Confirm if the SSH public key upload aligns with scheduled updates, development activities, or legitimate administrative tasks documented in change management systems.
39- **Consistency Check**: Compare the action against historical data of similar actions performed by the user or within the organization. If the action is consistent with past legitimate activities, it might indicate a false alarm.
40- **Verify through Outcomes**: Check the `aws.cloudtrail.response_elements` and the `event.outcome` to confirm if the upload was successful and intended according to policy.
41
42### Response and Remediation:
43
44- **Immediate Review and Reversal if Necessary**: If the upload was unauthorized, remove the uploaded SSH public key from the EC2 instance and review the instance's access logs for any suspicious activity.
45- **Enhance Monitoring and Alerts**: Adjust monitoring systems to alert on similar actions, especially those involving sensitive instances or unusual file extensions.
46- **Educate and Train**: Provide additional training to users with administrative rights on the importance of security best practices concerning SSH key management and the risks of unauthorized key uploads.
47- **Audit EC2 Instance Policies and Permissions**: Conduct a comprehensive audit of all EC2 instance policies and associated permissions to ensure they adhere to the principle of least privilege.
48- **Incident Response**: If there's an indication of malicious intent or a security breach, initiate the incident response protocol to mitigate any damage and prevent future occurrences.
49
50### Additional Information:
51
52For further guidance on managing EC2 instances and securing AWS environments, refer to the [AWS EC2 Instance Connect documentation](https://docs.aws.amazon.com/ec2-instance-connect/latest/APIReference/API_SendSSHPublicKey.html) and AWS best practices for security. Additionally, consult the following resources for specific details on SSH key management and privilege escalation techniques:
53- [Stratus Red Team - AWS EC2 Instance Connect](https://stratus-red-team.cloud/attack-techniques/AWS/aws.lateral-movement.ec2-instance-connect/)
54- [HackTricks - AWS EC2 Privilege Escalation](https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc)
55- [AWS EC2 Instance Connect API Reference](https://docs.aws.amazon.com/ec2-instance-connect/latest/APIReference/API_SendSSHPublicKey.html)
56"""
57references = [
58 "https://stratus-red-team.cloud/attack-techniques/AWS/aws.lateral-movement.ec2-instance-connect/",
59 "https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc",
60 "https://medium.parttimepolymath.net/aws-ec2-instance-connect-a-very-neat-trick-4d2fc0c28010",
61 "https://docs.aws.amazon.com/ec2-instance-connect/latest/APIReference/API_SendSSHPublicKey.html",
62 "https://docs.aws.amazon.com/ec2-instance-connect/latest/APIReference/API_SendSerialConsoleSSHPublicKey.html",
63]
64risk_score = 47
65rule_id = "873b5452-074e-11ef-852e-f661ea17fbcc"
66severity = "medium"
67tags = [
68 "Domain: Cloud",
69 "Data Source: AWS",
70 "Data Source: Amazon Web Services",
71 "Data Source: AWS EC2",
72 "Use Case: Identity and Access Audit",
73 "Tactic: Privilege Escalation",
74]
75timestamp_override = "event.ingested"
76type = "query"
77
78query = '''
79event.dataset: aws.cloudtrail
80 and event.provider: ec2-instance-connect.amazonaws.com
81 and event.action: (SendSSHPublicKey or SendSerialConsoleSSHPublicKey)
82 and event.outcome: success
83'''
84
85
86[[rule.threat]]
87framework = "MITRE ATT&CK"
88[[rule.threat.technique]]
89id = "T1098"
90name = "Account Manipulation"
91reference = "https://attack.mitre.org/techniques/T1098/"
92[[rule.threat.technique.subtechnique]]
93id = "T1098.004"
94name = "SSH Authorized Keys"
95reference = "https://attack.mitre.org/techniques/T1098/004/"
96
97
98
99[rule.threat.tactic]
100id = "TA0004"
101name = "Privilege Escalation"
102reference = "https://attack.mitre.org/tactics/TA0004/"
Triage and Analysis
Investigating AWS EC2 Instance Connect SSH Public Key Uploaded
This rule detects when a new SSH public key is uploaded to an AWS EC2 instance using the EC2 Instance Connect service. Adversaries may upload SSH public keys to EC2 instances to maintain access to the instance. The rule also covers cases where the SendSerialConsoleSSHPublicKey
API action is used to upload an SSH public key to a serial connection, which can be exploited for privilege escalation.
Possible Investigation Steps:
- Identify the Actor: Review the
aws.cloudtrail.user_identity.arn
andaws.cloudtrail.user_identity.access_key_id
fields to identify who performed the action. Verify if this actor typically performs such actions and if they have the necessary permissions. - Review the Request Details: Examine the
aws.cloudtrail.request_parameters
to understand the specific details of the SSH public key upload. Look for any unusual parameters that could suggest unauthorized or malicious modifications. - Analyze the Source of the Request: Investigate the
source.ip
andsource.geo
fields to determine the geographical origin of the request. An external or unexpected location might indicate compromised credentials or unauthorized access. - Contextualize with Timestamp: Use the
@timestamp
field to check when the SSH public key was uploaded. Changes during non-business hours or outside regular maintenance windows might require further scrutiny. - Correlate with Other Activities: Search for related CloudTrail events before and after this action to see if the same actor or IP address engaged in other potentially suspicious activities.
- Check for Serial Console Access: If the
SendSerialConsoleSSHPublicKey
action was used, verify if theec2:EnableSerialConsoleAccess
permission was also used, which might indicate an attempt to enable and exploit the serial console.
False Positive Analysis:
- Legitimate Administrative Actions: Confirm if the SSH public key upload aligns with scheduled updates, development activities, or legitimate administrative tasks documented in change management systems.
- Consistency Check: Compare the action against historical data of similar actions performed by the user or within the organization. If the action is consistent with past legitimate activities, it might indicate a false alarm.
- Verify through Outcomes: Check the
aws.cloudtrail.response_elements
and theevent.outcome
to confirm if the upload was successful and intended according to policy.
Response and Remediation:
- Immediate Review and Reversal if Necessary: If the upload was unauthorized, remove the uploaded SSH public key from the EC2 instance and review the instance's access logs for any suspicious activity.
- Enhance Monitoring and Alerts: Adjust monitoring systems to alert on similar actions, especially those involving sensitive instances or unusual file extensions.
- Educate and Train: Provide additional training to users with administrative rights on the importance of security best practices concerning SSH key management and the risks of unauthorized key uploads.
- Audit EC2 Instance Policies and Permissions: Conduct a comprehensive audit of all EC2 instance policies and associated permissions to ensure they adhere to the principle of least privilege.
- Incident Response: If there's an indication of malicious intent or a security breach, initiate the incident response protocol to mitigate any damage and prevent future occurrences.
Additional Information:
For further guidance on managing EC2 instances and securing AWS environments, refer to the AWS EC2 Instance Connect documentation and AWS best practices for security. Additionally, consult the following resources for specific details on SSH key management and privilege escalation techniques:
References
Related rules
- AWS IAM User Created Access Keys For Another User
- AWS IAM AdministratorAccess Policy Attached to Group
- AWS IAM AdministratorAccess Policy Attached to Role
- AWS IAM AdministratorAccess Policy Attached to User
- AWS IAM Assume Role Policy Update