Elastic high stable kql

AWS SageMaker Execution Role Passed by Unusual Principal

Identifies the first time an IAM principal passes a given execution role (`roleArn`) to an Amazon SageMaker resource, via `CreateNotebookInstance`, `CreateTrainingJob`, `CreateProcessingJob`, `CreateAutoMLJob`, or `CreatePipeline`. These actions require `iam:PassRole` and attach an IAM role that the created resource then runs as. An adversary holding both SageMaker create permissions and a broad `iam:PassRole` grant can pass a more privileged role to a resource they control and execute code as that role, escalating privileges. The rule keys on the combination of the calling principal and the passed `roleArn`, so it surfaces a principal using an execution role it has not used before in the last 7 days; a role whose account differs from the caller's, or that is more privileged than the caller, is especially suspicious.

View Source

Detection Logic

FROM logs-aws.cloudtrail-*
| WHERE data_stream.dataset == "aws.cloudtrail"
    
AND event.provider == "sagemaker.amazonaws.com"
    
AND event.action IN (
      "CreateNotebookInstance",
      "CreateTrainingJob",
      "CreateProcessingJob",
      "CreateAutoMLJob",
      "CreatePipeline"
    )
    
AND event.outcome == "success"
    
AND aws.cloudtrail.user_identity.type != "AWSService"
| GROK aws.cloudtrail.request_parameters """.*roleArn=(?<Esql.aws_cloudtrail_request_parameters_role_arn>arn:aws[a-z-]*:iam::[0-9]{12}:role/[^,}]+).*"""
| WHERE Esql.aws_cloudtrail_request_parameters_role_arn IS NOT NULL
| EVAL Esql.principal_arn = COALESCE(
    aws.cloudtrail.user_identity.session_context.session_issuer.arn,
    aws.cloudtrail.user_identity.arn
  )
| STATS
    Esql.timestamp_min = MIN(@timestamp),
    Esql.timestamp_max = MAX(@timestamp),
    Esql.ingested_min = MIN(COALESCE(event.ingested, @timestamp)),
    Esql.event_count = COUNT(*),
    Esql.event_action_values = VALUES(event.action),
    Esql.source_ip_values = VALUES(source.ip),
    Esql.user_agent_original_values = VALUES(user_agent.original),
    Esql.user_identity_arn_values = VALUES(aws.cloudtrail.user_identity.arn),
    Esql.cloud_account_id_values = VALUES(cloud.account.id),
    Esql.cloud_region_values = VALUES(cloud.region)
  BY Esql.principal_arn,
     Esql.aws_cloudtrail_request_parameters_role_arn
| WHERE Esql.ingested_min >= NOW() - 10 minutes
| KEEP Esql.*

False Positives

⚠ MLOps pipelines and data science teams routinely create SageMaker resources with execution roles, and new pipelines or team members appear as new principals on first use. Verify the principal in `aws.cloudtrail.user_identity.arn`, the passed roleArn in `aws.cloudtrail.request_parameters`, and whether the role's privileges and the activity are approved. Known automation roles can be excluded after validation.

Field Validations

Loading…

Comments (0)

Loading comments...