cloudtrail

SES Identity Has Been Deleted

Nov 2, 2023 · attack.defense_evasion attack.t1070 ·

Detects an instance of an SES identity being deleted via the "DeleteIdentity" event. This may be an indicator of an adversary removing the account that carried out suspicious or malicious activities

AWS S3 Bucket Versioning Disable

Oct 28, 2023 · attack.impact attack.t1490 ·

Share on:

Detects when S3 bucket versioning is disabled. Threat actors use this technique during AWS ransomware incidents prior to deleting S3 objects.

AWS Glue Development Endpoint Activity

Oct 18, 2023 · attack.privilege_escalation ·

Share on:

Detects possible suspicious glue development endpoint activity.

AWS EC2 Startup Shell Script Change

Oct 17, 2023 · attack.execution attack.t1059.001 attack.t1059.003 attack.t1059.004 ·

Share on:

Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.

AWS EC2 VM Export Failure

Oct 17, 2023 · attack.collection attack.t1005 attack.exfiltration attack.t1537 ·

Share on:

An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.

AWS RDS Master Password Change

Oct 17, 2023 · attack.exfiltration attack.t1020 ·

Share on:

Detects the change of database master password. It may be a part of data exfiltration.

AWS Attached Malicious Lambda Layer

Oct 12, 2023 · attack.privilege_escalation ·

Share on:

Detects when an user attached a Lambda layer to an existing function to override a library that is in use by the function, where their malicious code could utilize the function's IAM role for AWS API calls. This would give an adversary access to the privileges associated with the Lambda service role that is attached to that function.

AWS CloudTrail Important Change

Oct 12, 2023 · attack.defense_evasion attack.t1562.001 ·

Share on:

Detects disabling, deleting and updating of a Trail

AWS Config Disabling Channel/Recorder

Oct 12, 2023 · attack.defense_evasion attack.t1562.001 ·

Share on:

Detects AWS Config Service disabling

AWS EC2 Disable EBS Encryption

Oct 12, 2023 · attack.impact attack.t1486 attack.t1565 ·

Share on:

Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. Disabling default encryption does not change the encryption status of your existing volumes.

AWS ECS Task Definition That Queries The Credential Endpoint

Oct 12, 2023 · attack.persistence attack.t1525 ·

Share on:

Detects when an Elastic Container Service (ECS) Task Definition includes a command to query the credential endpoint. This can indicate a potential adversary adding a backdoor to establish persistence or escalate privileges.

AWS EFS Fileshare Modified or Deleted

Oct 12, 2023 · attack.impact ·

Share on:

Detects when a EFS Fileshare is modified or deleted. You can't delete a file system that is in use. If the file system has any mount targets, the adversary must first delete them, so deletion of a mount will occur before deletion of a fileshare.

AWS EFS Fileshare Mount Modified or Deleted

Oct 12, 2023 · attack.impact attack.t1485 ·

Share on:

Detects when a EFS Fileshare Mount is modified or deleted. An adversary breaking any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts.

AWS EKS Cluster Created or Deleted

Oct 12, 2023 · attack.impact attack.t1485 ·

Share on:

Identifies when an EKS cluster is created or deleted.

AWS ElastiCache Security Group Created

Oct 12, 2023 · attack.persistence attack.t1136 attack.t1136.003 ·

Share on:

Detects when an ElastiCache security group has been created.

AWS ElastiCache Security Group Modified or Deleted

Oct 12, 2023 · attack.impact attack.t1531 ·

Share on:

Identifies when an ElastiCache security group has been modified or deleted.

AWS GuardDuty Important Change

Oct 12, 2023 · attack.defense_evasion attack.t1562.001 ·

Share on:

Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs.

AWS IAM Backdoor Users Keys

Oct 12, 2023 · attack.persistence attack.t1098 ·

Share on:

Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS environment. Also with this alert, you can detect a flow of AWS keys in your org.

AWS IAM S3Browser LoginProfile Creation

Oct 12, 2023 · attack.execution attack.persistence attack.t1059.009 attack.t1078.004 ·

Share on:

Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.

AWS IAM S3Browser Templated S3 Bucket Policy Creation

Oct 12, 2023 · attack.execution attack.t1059.009 attack.persistence attack.t1078.004 ·

Share on:

Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "".

AWS IAM S3Browser User or AccessKey Creation

Oct 12, 2023 · attack.execution attack.persistence attack.t1059.009 attack.t1078.004 ·

Share on:

Detects S3 Browser utility creating IAM User or AccessKey.

AWS Identity Center Identity Provider Change

Oct 12, 2023 · attack.persistence attack.t1556 ·

Share on:

Detects a change in the AWS Identity Center (FKA AWS SSO) identity provider. A change in identity provider allows an attacker to establish persistent access or escalate privileges via user impersonation.

AWS Root Credentials

Oct 12, 2023 · attack.privilege_escalation attack.t1078.004 ·

Share on:

Detects AWS root account usage

AWS Route 53 Domain Transfer Lock Disabled

Oct 12, 2023 · attack.persistence attack.credential_access attack.t1098 ·

Share on:

Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar.

AWS Route 53 Domain Transferred to Another Account

Oct 12, 2023 · attack.persistence attack.credential_access attack.t1098 ·

Share on:

Detects when a request has been made to transfer a Route 53 domain to another AWS account.

AWS S3 Data Management Tampering

Oct 12, 2023 · attack.exfiltration attack.t1537 ·

Share on:

Detects when a user tampers with S3 data management in Amazon Web Services.

AWS SecurityHub Findings Evasion

Oct 12, 2023 · attack.defense_evasion attack.t1562 ·

Share on:

Detects the modification of the findings on SecurityHub.

AWS Snapshot Backup Exfiltration

Oct 12, 2023 · attack.exfiltration attack.t1537 ·

Share on:

Detects the modification of an EC2 snapshot's permissions to enable access from another account

AWS STS AssumeRole Misuse

Oct 12, 2023 · attack.lateral_movement attack.privilege_escalation attack.t1548 attack.t1550 attack.t1550.001 ·

Share on:

Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.

AWS STS GetSessionToken Misuse

Oct 12, 2023 · attack.lateral_movement attack.privilege_escalation attack.t1548 attack.t1550 attack.t1550.001 ·

Share on:

Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.

AWS Suspicious SAML Activity

Oct 12, 2023 · attack.initial_access attack.t1078 attack.lateral_movement attack.t1548 attack.privilege_escalation attack.t1550 attack.t1550.001 ·

Share on:

Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.

AWS User Login Profile Was Modified

Oct 12, 2023 · attack.persistence attack.t1098 ·

Share on:

An attacker with the iam:UpdateLoginProfile permission on other users can change the password used to login to the AWS console on any user that already has a login profile setup. With this alert, it is used to detect anyone is changing password on behalf of other users.

Potential Bucket Enumeration on AWS

Oct 12, 2023 · attack.discovery attack.t1580 ·

Share on:

Looks for potential enumeration of AWS buckets via ListBuckets.

Restore Public AWS RDS Instance

Oct 12, 2023 · attack.exfiltration attack.t1020 ·

Share on:

Detects the recovery of a new public database instance from a snapshot. It may be a part of data exfiltration.