Elastic unknown experimental kql

SNS Topic Created by Rare User

This hunting query gathers evidence of an SNS topic created by a user who does not typically perform this action. Adversaries may create SNS topics to stage capabilities for data exfiltration or other malicious activities.

View Source

Detection Logic

from logs-aws.cloudtrail-*
| WHERE @timestamp > now() - 7 day
| WHERE
    event.dataset == "aws.cloudtrail" 
AND
    event.provider == "sns.amazonaws.com" 
AND
    event.action == "CreateTopic"
    and aws.cloudtrail.user_identity.type == "AssumedRole"
| DISSECT aws.cloudtrail.request_parameters "{%{?topic_name_key}=%{topic_name}}"
| DISSECT aws.cloudtrail.user_identity.arn "%{?}:assumed-role/%{assumed_role_name}/%{entity}"
| DISSECT user_agent.original "%{user_agent_name} %{?user_agent_remainder}"
| WHERE STARTS_WITH(entity, "i-")
| KEEP cloud.account.id, entity, assumed_role_name, cloud.region, user_agent_name
| STATS regional_topic_created_count = COUNT(*) by cloud.account.id, entity, assumed_role_name, cloud.region, user_agent_name
| SORT regional_topic_created_count ASC

False Positives

  • ⚠ It is unusual for credentials from an assumed role for an EC2 instance to be creating SNS topics randomly.
  • ⚠ If a user identity access key (`aws.cloudtrail.user_identity.access_key_id`) exists in the CloudTrail audit log, then this request was accomplished via the CLI or programmatically. These keys could be compromised and warrant further investigation.
  • ⚠ Pivot into `Publish` API actions being called to this specific topic to identify which AWS resource is publishing messages. With access to the topic, you could further investigate the subscribers list to identify unauthorized subscribers.

Field Validations

Loading…

Comments (0)

Loading comments...