Elastic medium stable kql

First Time AWS CloudFormation Stack Creation

This rule detects the first time a principal calls AWS CloudFormation CreateStack, CreateStackSet or CreateStackInstances API. CloudFormation is used to create a collection of cloud resources called a stack, via a defined template file. An attacker with the appropriate privileges could leverage CloudFormation to create specific resources needed to further exploit the environment. This is a new terms rule that looks for the first instance of this behavior for a role or IAM user within a particular account.

View Source

Detection Logic

data_stream.dataset:aws.cloudtrail and event.provider:cloudformation.amazonaws.com and
    event.action: (CreateStack or CreateStackInstances) 
    and event.outcome:success
    and not user_agent.original: (*Terraform* or *Pulumi*)

False Positives

⚠ Verify whether the user identity should be using the triggered API. If known behavior is causing false positives, it can be exempted from the rule. The "history_window_start" value can be modified to reflect the expected frequency of known activity within a particular environment.

Field Validations

Loading…

Comments (0)

Loading comments...