Elastic high stable kql

AWS EC2 Instance Profile Associated with Running Instance

Identifies when an IAM instance profile is associated with a running EC2 instance or replaces the existing association. These APIs change which role credentials the instance obtains via the instance metadata service without terminating the instance. Attackers who can call `AssociateIamInstanceProfile` or `ReplaceIamInstanceProfile` may attach a more privileged role to a workload they control, enabling privilege escalation or lateral movement from the instance.

View Source

Detection Logic

event.dataset: "aws.cloudtrail"
    and event.provider: "ec2.amazonaws.com"
    and event.action: ("AssociateIamInstanceProfile" or "ReplaceIamInstanceProfile")
    and event.outcome: "success"
    and not aws.cloudtrail.user_identity.type: "AWSService" 
    and not aws.cloudtrail.user_identity.invoked_by: "ssm.amazonaws.com"

False Positives

⚠ Blue/green deployments, instance remediation, and automation may rebind instance profiles intentionally. Confirm the instance id, new `iamInstanceProfile` or `IamInstanceProfile` ARN, and change records. Exclude known automation roles after validation.

Field Validations

Loading…

Comments (0)

Loading comments...