Elastic unknown experimental kql

SSM SendCommand API Used by EC2 Instance

An attacker with compromised EC2 instance credentials, may use those credentials to attempt remote code execution against the EC2 instance from which the credentials were compromised via SSM SendCommand API.

View Source

Detection Logic

from logs-aws.cloudtrail-*
| where @timestamp > now() - 7 day
| where event.dataset == "aws.cloudtrail"
    and event.provider == "ssm.amazonaws.com"
    and aws.cloudtrail.user_identity.type == "AssumedRole"
    and event.action == "SendCommand"
    and user.id like "*:i-*"
| keep @timestamp, event.provider, event.action, aws.cloudtrail.user_identity.type, user.id, aws.cloudtrail.request_parameters

False Positives

⚠ The indicator that this is an EC2 instance assuming a role and performing the action, is the use of the instance id beginning with -i as the session name.
⚠ Session name is attached to the end of the `user.id` field and the `aws.cloudtrail.user_identity.arn`.

Field Validations

Loading…

Comments (0)

Loading comments...