Suspicious Linux Process Connection to AWS IoT Core MQTT

  1[metadata]
  2creation_date = "2026/10/06"
  3integration = ["endpoint"]
  4maturity = "production"
  5min_stack_comments = "DNS for Linux support was introduced in 9.3.0"
  6min_stack_version = "9.3.0"
  7updated_date = "2026/10/06"
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Identifies a Linux process running from a potentially suspicious location that resolves an account-specific AWS IoT Core
 13data endpoint and then connects over TCP/443 or TCP/8883. Adversaries can use an attacker-controlled AWS IoT Core MQTT
 14broker to relay commands, results, and files without a direct connection from the compromised host to the operator's
 15backend server.
 16"""
 17false_positives = [
 18    """
 19    IoT development, device testing, telemetry agents, installers, and administrative scripts can legitimately run from
 20    temporary or hidden paths and connect to AWS IoT Core. Confirm the executable, parent process, source asset role,
 21    and complete AWS IoT endpoint before creating an exception. Scope exceptions to an approved executable and endpoint
 22    pair rather than excluding AWS IoT or a writable directory globally.
 23    """,
 24]
 25from = "now-9m"
 26index = ["logs-endpoint.events.network-*"]
 27language = "eql"
 28license = "Elastic License v2"
 29name = "Suspicious Linux Process Connection to AWS IoT Core MQTT"
 30note = """## Triage and analysis
 31
 32### Investigating Suspicious Linux Process Connection to AWS IoT Core MQTT
 33
 34AWS IoT Core supports direct MQTT over TLS with X.509 client certificates on TCP/8883 and on TCP/443. AWS IoT data
 35endpoints are account- and region-specific. ATS endpoints normally follow
 36`<account-specific-prefix>-ats.iot.<region>.amazonaws.com`, while legacy endpoints omit `-ats`. China regions can use
 37`<account-specific-prefix>.ats.iot.<region>.amazonaws.com.cn`. An attacker can provision a broker in an account they
 38control, place matching client credentials and an agent on a compromised host, and use the broker as a rendezvous point
 39for command and control.
 40
 41This rule requires the same Linux process to successfully resolve an AWS IoT data endpoint and then attempt an outbound
 42TCP connection to one of the resolved IP addresses on port 443 or 8883 within one minute. The process must run from a
 43temporary, hidden, boot, log, or per-user runtime path. The DNS-to-connection sequence identifies the service without
 44decrypting TLS. It does not reveal MQTT client IDs, topics, commands, results, or file content.
 45
 46### Possible investigation steps
 47
 48- Review `dns.question.name` and preserve the complete account-specific endpoint. Determine whether the endpoint, AWS
 49  region, source asset, and executable are approved for AWS IoT use.
 50- Inspect the process executable, hash, ancestry, user, working directory, creation time, and prevalence. Determine how
 51  the binary or script reached the host and whether it has persistence.
 52- Review nearby file events for X.509 certificates and private keys introduced before the connection. Preserve
 53  certificate metadata and fingerprints, but protect private-key contents as sensitive evidence.
 54- Examine network events from the same `process.entity_id`. TCP/8883 conventionally carries MQTT over TLS. On TCP/443,
 55  correlate with packet telemetry and verify that the client offered ALPN `x-amzn-mqtt-ca`.
 56- Check for files created or read by the process, child process activity, process discovery, and changes in inbound or
 57  outbound byte volume. These can support file transfer or command execution but do not establish transferred content.
 58- Search for the same endpoint, process hash, executable path, certificate fingerprint, user, and parent chain across
 59  the environment.
 60- The sequence confirms that the destination IP appeared in the DNS answer, but shared or rotating AWS infrastructure
 61  can still create an incidental correlation. Validate packet-level SNI and application protocol where available.
 62
 63### False positive analysis
 64
 65- Approved IoT clients, SDK tests, deployment scripts, and device-management tooling can use AWS IoT Core. Verify the
 66  business owner and expected source-to-endpoint relationship.
 67- Temporary installers and development builds can execute from writable paths. Validate the executable hash, parent,
 68  user, timing, and whether the endpoint belongs to an approved AWS account.
 69- Red-team and lab use can be indistinguishable from malicious use. Confirm authorized testing before suppressing the
 70  activity.
 71
 72### Response and remediation
 73
 74- If unauthorized, isolate the host, preserve the process and credential material, terminate the process and active
 75  socket, and block the exact endpoint at DNS and egress controls.
 76- Do not block all Amazon addresses or `amazonaws.com`. Destination IPs can rotate and Amazon infrastructure is shared.
 77- Search backward for the initial code-execution and credential-placement mechanism and review persistence.
 78- Report confirmed attacker-controlled AWS IoT infrastructure to AWS with the complete endpoint and supporting
 79  timestamps.
 80"""
 81references = [
 82    "https://hackerhermanos.com/posts/aws-iot-mqtt-red-teamer/",
 83    "https://docs.aws.amazon.com/iot/latest/developerguide/protocols.html",
 84    "https://docs.aws.amazon.com/iot/latest/developerguide/x509-client-certs.html",
 85    "https://github.com/MythicC2Profiles/mqtt",
 86]
 87risk_score = 73
 88rule_id = "3c92b53d-3376-4c79-86fb-7e785fe8d882"
 89setup = """## Setup
 90
 91This rule requires Elastic Defend network events from Linux hosts.
 92
 93Linux DNS events from Elastic Defend require Elastic Stack 9.3.0 or later. The integration policy must collect DNS
 94lookup and network connection events with `process.entity_id`, `process.executable`, `dns.question.name`,
 95`dns.resolved_ip`, `destination.ip`, `destination.port`, and `network.transport`.
 96
 97TLS decryption is not required. The rule uses process-attributed DNS and connection metadata. Packet-level TLS telemetry
 98is recommended during investigation to confirm SNI and, for direct MQTT with X.509 authentication on TCP/443, the
 99client-offered ALPN value `x-amzn-mqtt-ca`.
100"""
101severity = "high"
102tags = [
103    "Domain: Endpoint",
104    "Domain: Network",
105    "Domain: OT/IoT",
106    "OS: Linux",
107    "Platform: Linux",
108    "Platform: AWS",
109    "Use Case: Threat Detection",
110    "Tactic: Command and Control",
111    "Data Source: Elastic Defend",
112    "Service: AWS IoT",
113    "Rule Type: Event Correlation (EQL)",
114    "Resources: Investigation Guide",
115]
116timestamp_override = "event.ingested"
117type = "eql"
118
119query = '''
120sequence by host.id, process.entity_id with maxspan=1m
121  [network where host.os.type == "linux" and
122    event.action == "lookup_result" and
123    dns.question.name regex~ (
124      """[^.]+-ats\.iot\.[^.]+\.amazonaws\.com""",
125      """[^.]+\.iot\.[^.]+\.amazonaws\.com""",
126      """[^.]+-ats\.iot\.[^.]+\.amazonaws\.com\.cn""",
127      """[^.]+\.ats\.iot\.[^.]+\.amazonaws\.com\.cn""",
128      """[^.]+\.iot\.[^.]+\.amazonaws\.com\.cn"""
129    ) and
130    (
131      process.executable like (
132        "/boot/*",
133        "/dev/shm/*",
134        "/tmp/*",
135        "/var/tmp/*",
136        "/var/log/*",
137        "/var/run/user/*",
138        "/run/user/*",
139        "/home/*/.*",
140        "/root/.*"
141      ) or
142      process.name like ".*"
143    )] by dns.resolved_ip
144  [network where host.os.type == "linux" and
145    event.action == "connection_attempted" and
146    network.direction in ("egress", "outbound") and
147    network.transport == "tcp" and
148    destination.port in (443, 8883) and
149    not (
150      destination.ip == null or
151      destination.ip == "0.0.0.0" or
152      cidrmatch(
153        destination.ip,
154        "10.0.0.0/8",
155        "100.64.0.0/10",
156        "127.0.0.0/8",
157        "169.254.0.0/16",
158        "172.16.0.0/12",
159        "192.0.0.0/24",
160        "192.0.0.0/29",
161        "192.0.0.8/32",
162        "192.0.0.9/32",
163        "192.0.0.10/32",
164        "192.0.0.170/32",
165        "192.0.0.171/32",
166        "192.0.2.0/24",
167        "192.31.196.0/24",
168        "192.52.193.0/24",
169        "192.88.99.0/24",
170        "192.168.0.0/16",
171        "192.175.48.0/24",
172        "198.18.0.0/15",
173        "198.51.100.0/24",
174        "203.0.113.0/24",
175        "224.0.0.0/4",
176        "240.0.0.0/4",
177        "::1",
178        "FC00::/7",
179        "FE80::/10",
180        "FF00::/8"
181      )
182    )] by destination.ip
183'''
184
185
186[[rule.threat]]
187framework = "MITRE ATT&CK"
188[[rule.threat.technique]]
189id = "T1071"
190name = "Application Layer Protocol"
191reference = "https://attack.mitre.org/techniques/T1071/"
192[[rule.threat.technique.subtechnique]]
193id = "T1071.005"
194name = "Publish/Subscribe Protocols"
195reference = "https://attack.mitre.org/techniques/T1071/005/"
196
197
198
199[rule.threat.tactic]
200id = "TA0011"
201name = "Command and Control"
202reference = "https://attack.mitre.org/tactics/TA0011/"
203
204[rule.investigation_fields]
205field_names = [
206    "@timestamp",
207    "host.name",
208    "host.id",
209    "user.name",
210    "process.name",
211    "process.executable",
212    "process.entity_id",
213    "process.command_line",
214    "process.parent.name",
215    "dns.question.name",
216    "dns.resolved_ip",
217    "destination.ip",
218    "destination.port",
219    "network.direction",
220    "network.transport",
221]