Query: rule covering Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access
Matching passage: Sigma rule: Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access. Logsource: aws / cloudtrail. Rule: title: AWS Key Pair Import Activity id: 92f84194-8d9a-4ee0-8699-c30bfac59780 status: experimental description: 'Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations. ' references: - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ImportKeyPair.html author: Ivan Saakov date: 2024-12-19 tags: - attack.initial-access - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation logsource: product: aws service: cloudtrail detection: selection: eventSource: ec2.amazonaws.com eventName: ImportKeyPair condition: selection falsepositives: - Legitimate administrative actions by authorized users importing keys for valid purposes. - Automated processes for infrastructure setup may trigger this alert. - Verify the user identity, user agent, and source IP address to ensure they are expected. level: medium
Near-miss passage: Sigma rule: Identifies clients that may be performing DNS lookups associated with common currency mining pools.. Logsource: zeek / dns. Rule: title: DNS Events Related To Mining Pools id: bf74135c-18e8-4a72-a926-0e4f47888c19 status: test description: Identifies clients that may be performing DNS lookups associated with common currency mining pools. references: - https://github.com/Azure/Azure-Sentinel/blob/fa0411f9424b6c47b4d5a20165e4f1b168c1f103/Detections/ASimDNS/imDNS_Miners.yaml author: Saw Winn Naung, Azure-Sentinel, @neu5ron date: 2021-08-19 modified: 2022-07-07 tags: - attack.execution - attack.t1569.002 - attack.impact - attack.t1496 logsource: service: dns product: zeek detection: selection: query|endswith: - monerohash.com - do-dear.com - xmrminerpro.com - secumine.net - xmrpool.com - minexmr.org - hashanywhere.com - xmrget.com - mininglottery.eu - minergate.com - moriaxmr.com - multipooler.com - moneropools.com - xmrpool.eu - coolmining.club - supportxmr.com - minexmr.com - hashvault.pro - xmrpool.net - crypto-pool.fr - xmr.pt - miner.rocks - walpool.com - herominers.com - gntl.co.uk - semipool.com - coinfoundry.org - cryptoknight.cc - fairhash.org - baikalmine.com - tubepool.xyz - fairpool.xyz - asiapool.io - coinpoolit.webhop.me - nanopool.org - moneropool.com - miner.center - prohash.net - poolto.be - cryptoescrow.eu - monerominers.net - cryptonotepool.org - extrmepool.org - webcoin.me - kippo.eu - hashinvest.ws - monero.farm - linux-repository-updates.com - 1gh.com - dwarfpool.com - hash-to-coins.com - pool-proxy.com - hashfor.cash - fairpool.cloud - litecoinpool.org - mineshaft.ml - abcxyz.stream - moneropool.ru - cryptonotepool.org.uk - extremepool.org - extremehash.com - hashinvest.net - unipool.pro - crypto-pools.org - monero.net - backup-pool.com - mooo.com - freeyy.me - cryptonight.net - shscrypto.net exclude_answers: answers: - 127.0.0.1 - 0.0.0.0 exclude_rejected: rejected: 'true' condition: selection and not 1 of exclude_* falsepositives: - A DNS lookup does not necessarily mean a successful attempt, verify a) if there was a response using the zeek answers field, if there was then verify the connections (conn.log) to those IPs. b) verify if HTTP, SSL, or TLS activity to the domain that was queried. http.log field is 'host' and ssl/tls is 'server_name'. level: low