Anvilogic high experimental other

EC2 SystemsManager Exploitation AWS [snowflake-awscloudtrail]

Identifies execution of API commands for the System Security manager. These profiles can be leveraged to execute arbitrary code on EC2 instances as root/SYSTEM using EC2 Systems Manager. -- Threat Actor Association: LUCR-3

View Source

Detection Logic

select * from awscloudtrail where event_time > dateadd(hour, -2, sysdate()) and event_type = 'AwsApiCall' and ( event_name = 'AssociateIamInstanceProfile' or event_name = 'CreateRole' or event_name = 'AddRoleToInstanceProfile' or event_name = 'AttachRolePolicy' or event_name = 'UpdateInstanceInformation' or event_name = 'CreateInstanceProfile' ) and ( dest_role = 'SSM' or profile_name = 'SSM' )

Field Validations

Loading…

Comments (0)

Loading comments...