Elastic medium stable kql

AWS EC2 User Data Retrieval for EC2 Instance

Identifies discovery request DescribeInstanceAttribute with the attribute userData and instanceId in AWS CloudTrail logs. This may indicate an attempt to retrieve user data from an EC2 instance. Adversaries may use this information to gather sensitive data from the instance such as hardcoded credentials or to identify potential vulnerabilities. This is a New Terms rule that identifies the first time an IAM user or role requests the user data for a specific EC2 instance.

View Source

Detection Logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "ec2.amazonaws.com"
    and event.action: "DescribeInstanceAttribute"
    and event.outcome: "success"
    and aws.cloudtrail.flattened.request_parameters.attribute: "userData"
    and not aws.cloudtrail.user_identity.invoked_by: (
        "AWS Internal" or
        "cloudformation.amazonaws.com" or 
        "aidevops.amazonaws.com" or 
        "elasticmapreduce.amazonaws.com" or 
        "aiops.amazonaws.com"
    )
    and not user_agent.original: (*Terraform*)

Field Validations

Loading…

Comments (0)

Loading comments...