Elastic low stable kql

AWS Backup Resource Enumeration via Long-Term Access Key

Detects enumeration of AWS Backup resources using long-term IAM access keys (AKIA* prefix). AWS Backup protects EC2 instances, EBS volumes, RDS databases, DynamoDB tables, EFS file systems, and S3 buckets. An adversary who obtains long-term access keys may enumerate backup vaults, backup plans, and protected resources as a precursor to ransomware. Identifying which resources have recent backups (indicating high-value data) and what vault access policies can be modified to delete or corrupt the backups before encrypting the primary data.

View Source

Detection Logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "backup.amazonaws.com"
    and event.action: (
        "ListBackupVaults" or
        "ListBackupJobs" or
        "ListBackupPlans" or
        "ListProtectedResources" or
        "ListRecoveryPointsByBackupVault" or
        "GetBackupPlan" or
        "GetBackupVaultAccessPolicy" or
        "DescribeBackupJob" or
        "DescribeRecoveryPoint"
    )
    and event.outcome: "success"
    and aws.cloudtrail.user_identity.access_key_id: AKIA*

False Positives

⚠ Automated monitoring tools or compliance audit scripts using long-term IAM keys to inventory backup coverage will trigger this rule. Migrate automation to IAM roles with short-lived credentials. Long-term key usage for backup management is a security anti-pattern.

Field Validations

Loading…

Comments (0)

Loading comments...