deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Data Exfiltration to Unsanctioned Apps
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-23
ATT&CK techniques: T1537
Log source: m365/

Description:
Detects when a Microsoft Cloud App Security reported when a user or IP address uses an app that is not sanctioned to perform an activity that resembles an attempt to exfiltrate information from your organization.

Detection logic:
{
  "selection": {
    "eventSource": "SecurityComplianceCenter",
    "eventName": "Data exfiltration to unsanctioned apps",
    "status": "success"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
  - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
Sigma Detection Rule: Suspicious OAuth App File Download Activities
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-23
Log source: m365/

Description:
Detects when a Microsoft Cloud App Security reported when an app downloads multiple files from Microsoft SharePoint or Microsoft OneDrive in a manner that is unusual for the user.

Detection logic:
{
  "selection": {
    "eventSource": "SecurityComplianceCenter",
    "eventName": "Suspicious OAuth app file download activities",
    "status": "success"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
  - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
Sigma Detection Rule: Microsoft 365 - Unusual Volume of File Deletion
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: austinsonger
Date: 2021-08-19
ATT&CK techniques: T1485
Log source: m365/

Description:
Detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files.

Detection logic:
{
  "selection": {
    "eventSource": "SecurityComplianceCenter",
    "eventName": "Unusual volume of file deletion",
    "status": "success"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
  - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
Sigma Detection Rule: Microsoft 365 - Impossible Travel Activity
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2020-07-06
ATT&CK techniques: T1078
Log source: m365/

Description:
Detects when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossible travel.

Detection logic:
{
  "selection": {
    "eventSource": "SecurityComplianceCenter",
    "eventName": "Impossible travel activity",
    "status": "success"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
  - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
Sigma Detection Rule: Logon from a Risky IP Address
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-23
ATT&CK techniques: T1078
Log source: m365/

Description:
Detects when a Microsoft Cloud App Security reported when a user signs into your sanctioned apps from a risky IP address.

Detection logic:
{
  "selection": {
    "eventSource": "SecurityComplianceCenter",
    "eventName": "Log on from a risky IP address",
    "status": "success"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
  - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
Sigma Detection Rule: PST Export Alert Using eDiscovery Alert
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sorina Ionescu
Date: 2022-02-08
ATT&CK techniques: T1114
Log source: m365/

Description:
Alert on when a user has performed an eDiscovery search or exported a PST file from the search. This PST file usually has sensitive information including email body content

Detection logic:
{
  "selection": {
    "eventSource": "SecurityComplianceCenter",
    "eventName": "eDiscovery search started or exported",
    "status": "success"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/microsoft-365/compliance/alert-policies?view=o365-worldwide
Sigma Detection Rule: Microsoft 365 - Potential Ransomware Activity
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: austinsonger
Date: 2021-08-19
ATT&CK techniques: T1486
Log source: m365/

Description:
Detects when a Microsoft Cloud App Security reported when a user uploads files to the cloud that might be infected with ransomware.

Detection logic:
{
  "selection": {
    "eventSource": "SecurityComplianceCenter",
    "eventName": "Potential ransomware activity",
    "status": "success"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
  - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
Sigma Detection Rule: PST Export Alert Using New-ComplianceSearchAction
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nikita Khalimonenkov
Date: 2022-11-17
ATT&CK techniques: T1114
Log source: m365/

Description:
Alert when a user has performed an export to a search using 'New-ComplianceSearchAction' with the '-Export' flag. This detection will detect PST export even if the 'eDiscovery search or exported' alert is disabled in the O365.This rule will apply to ExchangePowerShell usage and from the cloud.

Detection logic:
{
  "selection": {
    "eventSource": "SecurityComplianceCenter",
    "Payload|contains|all": [
      "New-ComplianceSearchAction",
      "Export",
      "pst"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/powershell/module/exchange/new-compliancesearchaction?view=exchange-ps
Sigma Detection Rule: Suspicious Inbox Forwarding
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-22
ATT&CK techniques: T1020
Log source: m365/

Description:
Detects when a Microsoft Cloud App Security reported suspicious email forwarding rules, for example, if a user created an inbox rule that forwards a copy of all emails to an external address.

Detection logic:
{
  "selection": {
    "eventSource": "SecurityComplianceCenter",
    "eventName": "Suspicious inbox forwarding",
    "status": "success"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
  - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
Sigma Detection Rule: Activity from Infrequent Country
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-23
ATT&CK techniques: T1573
Log source: m365/

Description:
Detects when a Microsoft Cloud App Security reported when an activity occurs from a location that wasn't recently or never visited by any user in the organization.

Detection logic:
{
  "selection": {
    "eventSource": "SecurityComplianceCenter",
    "eventName": "Activity from infrequent country",
    "status": "success"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
  - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
Sigma Detection Rule: Azure Login Bypassing Conditional Access Policies
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Josh Nickels, Marius Rothenbücher
Date: 2025-01-08
ATT&CK techniques: T1078
Log source: m365/

Description:
Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.


Detection logic:
{
  "selection": {
    "Operation": "UserLoggedIn",
    "ApplicationId": "9ba1a5c7-f17a-4de9-a1f1-6178c8d51223",
    "ResultStatus": "Success",
    "RequestType": "Cmsi:Cmsi"
  },
  "filter_main_bjectid": {
    "ObjectId": "0000000a-0000-0000-c[PII_REDACTED]00000"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://labs.jumpsec.com/tokensmith-bypassing-intune-compliant-device-conditional-access/
  - https://github.com/JumpsecLabs/TokenSmith
Sigma Detection Rule: Disabling Multi Factor Authentication
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Splunk Threat Research Team (original rule), Harjot Singh @cyb3rjy0t (sigma rule)
Date: 2023-09-18
ATT&CK techniques: T1556.006
Log source: m365/

Description:
Detects disabling of Multi Factor Authentication.

Detection logic:
{
  "selection": {
    "Operation|contains": "Disable Strong Authentication."
  },
  "condition": "selection"
}

References:
  - https://research.splunk.com/cloud/c783dd98-c703-4252-9e8a-f19d9f5c949e/
Sigma Detection Rule: Suspicious Email Delivered In Microsoft 365
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
Date: 2026-01-27
ATT&CK techniques: T1566.001, T1566.002
Log source: m365/

Description:
Detects instances where an email, identified as malicious or suspicious by the Microsoft Defender for Office 365 (formerly ATP) engine, was delivered to a user's Inbox or Junk folder.
It might indicate that a potential threat, such as a spearphishing attachment or links, has bypassed initial blocking mechanisms and reached an end-user, requiring further investigation and potential remediation.


Detection logic:
{
  "selection": {
    "Workload": "ThreatIntelligence",
    "Operation": "TIMailData",
    "Directionality": "Inbound"
  },
  "filter_main_blocked": {
    "DeliveryAction": "Blocked"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://learn.microsoft.com/en-us/defender-office-365/threat-explorer-real-time-detections-about
  - https://research.splunk.com/cloud/605cc93a-70e4-4ee3-9a3d-1a62e8c9b6c2/
  - https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules/blob/e7250648cb16d4a497ae8737943bf010ea96d2e6/Defender%20For%20Cloud%20Apps/MaliciousEmailDeliveredInMailbox.md
Sigma Detection Rule: New Federated Domain Added
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Splunk Threat Research Team (original rule), Harjot Singh @cyb3rjy0t (sigma rule)
Date: 2023-09-18
ATT&CK techniques: T1484.002
Log source: m365/

Description:
Detects the addition of a new Federated Domain.

Detection logic:
{
  "selection_domain": {
    "Operation|contains": "domain"
  },
  "selection_operation": {
    "Operation|contains": [
      "add",
      "new"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://research.splunk.com/cloud/e155876a-6048-11eb-ae93-0242ac130002/
  - https://o365blog.com/post/aadbackdoor/
Sigma Detection Rule: New Federated Domain Added - Exchange
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Splunk Threat Research Team (original rule), '@ionsor (rule)'
Date: 2022-02-08
ATT&CK techniques: T1136.003
Log source: m365/

Description:
Detects the addition of a new Federated Domain.

Detection logic:
{
  "selection": {
    "eventSource": "Exchange",
    "eventName": "Add-FederatedDomain",
    "status": "success"
  },
  "condition": "selection"
}

References:
  - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
  - https://us-cert.cisa.gov/ncas/alerts/aa21-008a
  - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
  - https://www.sygnia.co/golden-saml-advisory
  - https://o365blog.com/post/aadbackdoor/
Sigma Detection Rule: AWS STS AssumeRole Misuse
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Austin Songer @austinsonger
Date: 2021-07-24
ATT&CK techniques: T1548, T1550, T1550.001
Log source: aws/

Description:
Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.

Detection logic:
{
  "selection": {
    "userIdentity.type": "AssumedRole",
    "userIdentity.sessionContext.sessionIssuer.type": "Role"
  },
  "condition": "selection"
}

References:
  - https://github.com/elastic/detection-rules/pull/1214
  - https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html
Sigma Detection Rule: AWS RDS Master Password Change
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: faloker
Date: 2020-02-12
ATT&CK techniques: T1020
Log source: aws/

Description:
Detects the change of database master password. It may be a part of data exfiltration.

Detection logic:
{
  "selection_source": {
    "eventSource": "rds.amazonaws.com",
    "responseElements.pendingModifiedValues.masterUserPassword|contains": "*",
    "eventName": "ModifyDBInstance"
  },
  "condition": "selection_source"
}

References:
  - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/rds__explore_snapshots/main.py
Sigma Detection Rule: Restore Public AWS RDS Instance
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: faloker
Date: 2020-02-12
ATT&CK techniques: T1020
Log source: aws/

Description:
Detects the recovery of a new public database instance from a snapshot. It may be a part of data exfiltration.

Detection logic:
{
  "selection_source": {
    "eventSource": "rds.amazonaws.com",
    "responseElements.publiclyAccessible": "true",
    "eventName": "RestoreDBInstanceFromDBSnapshot"
  },
  "condition": "selection_source"
}

References:
  - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/rds__explore_snapshots/main.py
Sigma Detection Rule: AWS VPC Flow Logs Deleted
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Ivan Saakov
Date: 2025-10-19
Log source: aws/

Description:
Detects the deletion of one or more VPC Flow Logs in AWS Elastic Compute Cloud (EC2) through the DeleteFlowLogs API call.
Adversaries may delete flow logs to evade detection or remove evidence of network activity, hindering forensic investigations and visibility into malicious operations.


Detection logic:
{
  "selection_event_name": {
    "eventName": "DeleteFlowLogs"
  },
  "selection_status_success": {
    "errorCode": "Success"
  },
  "selection_status_null": {
    "errorCode": null
  },
  "condition": "selection_event_name and 1 of selection_status_*"
}

References:
  - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteFlowLogs.html
  - https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/delete-flow-logs.html
  - https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_ec2_flow_log_deletion
Sigma Detection Rule: AWS KMS Imported Key Material Usage
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: toopricey
Date: 2025-10-18
ATT&CK techniques: T1486, T1608.003
Log source: aws/

Description:
Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal.


Detection logic:
{
  "selection": {
    "eventSource": "kms.amazonaws.com",
    "eventName": [
      "ImportKeyMaterial",
      "DeleteImportedKeyMaterial"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.chrisfarris.com/post/effective-aws-ransomware/
  - https://docs.aws.amazon.com/kms/latest/developerguide/ct-importkeymaterial.html
  - https://docs.aws.amazon.com/kms/latest/developerguide/ct-deleteimportedkeymaterial.html
Sigma Detection Rule: AWS IAM S3Browser Templated S3 Bucket Policy Creation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: daniel.bohannon@permiso.io (@danielhbohannon)
Date: 2023-05-17
ATT&CK techniques: T1059.009, T1078.004
Log source: aws/

Description:
Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "<YOUR-BUCKET-NAME>".

Detection logic:
{
  "selection": {
    "eventSource": "iam.amazonaws.com",
    "eventName": "PutUserPolicy",
    "userAgent|contains": "S3 Browser",
    "requestParameters|contains|all": [
      "\"arn:aws:s3:::<YOUR-BUCKET-NAME>/*\"",
      "\"s3:GetObject\"",
      "\"Allow\""
    ]
  },
  "condition": "selection"
}

References:
  - https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor
Sigma Detection Rule: AWS EKS Cluster Created or Deleted
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Austin Songer
Date: 2021-08-16
ATT&CK techniques: T1485
Log source: aws/

Description:
Identifies when an EKS cluster is created or deleted.

Detection logic:
{
  "selection": {
    "eventSource": "eks.amazonaws.com",
    "eventName": [
      "CreateCluster",
      "DeleteCluster"
    ]
  },
  "condition": "selection"
}

References:
  - https://any-api.com/amazonaws_com/eks/docs/API_Description
Sigma Detection Rule: AWS STS GetSessionToken Misuse
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Austin Songer @austinsonger
Date: 2021-07-24
ATT&CK techniques: T1548, T1550, T1550.001
Log source: aws/

Description:
Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.

Detection logic:
{
  "selection": {
    "eventSource": "sts.amazonaws.com",
    "eventName": "GetSessionToken",
    "userIdentity.type": "IAMUser"
  },
  "condition": "selection"
}

References:
  - https://github.com/elastic/detection-rules/pull/1213
  - https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html
Sigma Detection Rule: AWS Successful Console Login Without MFA
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Thuya@Hacktilizer, Ivan Saakov
Date: 2025-10-18
ATT&CK techniques: T1078.004
Log source: aws/

Description:
Detects successful AWS console logins that were performed without Multi-Factor Authentication (MFA).
This alert can be used to identify potential unauthorized access attempts, as logging in without MFA can indicate compromised credentials or misconfigured security settings.


Detection logic:
{
  "selection": {
    "eventName": "ConsoleLogin",
    "additionalEventData.MFAUsed": "NO",
    "responseElements.ConsoleLogin": "Success"
  },
  "condition": "selection"
}

References:
  - https://securitylabs.datadoghq.com/cloud-security-atlas/vulnerabilities/iam-user-without-mfa/
  - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html
Sigma Detection Rule: AWS GuardDuty Detector Deleted Or Updated
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: suktech24
Date: 2025-11-27
ATT&CK techniques: T1685, T1685.002
Log source: aws/

Description:
Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities.
Upon deletion, GuardDuty stops monitoring the environment and all existing findings are lost.
Verify with the user identity that this activity is legitimate.


Detection logic:
{
  "selection_event_source": {
    "eventSource": "guardduty.amazonaws.com"
  },
  "selection_action_delete": {
    "eventName": "DeleteDetector"
  },
  "selection_action_update": {
    "eventName": "UpdateDetector",
    "requestParameters.enable": "false"
  },
  "selection_status_success": {
    "errorCode": "Success"
  },
  "selection_status_null": {
    "errorCode": null
  },
  "condition": "selection_event_source and 1 of selection_action_* and 1 of selection_status_*"
}

References:
  - https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeleteDetector.html
  - https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateDetector.html
  - https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_suspend-disable.html
  - https://docs.datadoghq.com/security/default_rules/719-39f-9cd/
  - https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-guardduty-detector-is-enabled
Sigma Detection Rule: New AWS Lambda Function URL Configuration Created
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Ivan Saakov
Date: 2024-12-19
Log source: aws/

Description:
Detects when a user creates a Lambda function URL configuration, which could be used to expose the function to the internet and potentially allow unauthorized access to the function's IAM role for AWS API calls.
This could give an adversary access to the privileges associated with the Lambda service role that is attached to that function.


Detection logic:
{
  "selection": {
    "eventSource": "lambda.amazonaws.com",
    "eventName": "CreateFunctionUrlConfig"
  },
  "condition": "selection"
}

References:
  - https://docs.aws.amazon.com/lambda/latest/dg/API_CreateFunctionUrlConfig.html
  - https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc
  - https://www.wiz.io/blog/how-to-set-secure-defaults-on-aws
Sigma Detection Rule: New Network ACL Entry Added
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: jamesc-grafana
Date: 2024-07-11
ATT&CK techniques: T1686.001
Log source: aws/

Description:
Detects that network ACL entries have been added to a route table which could indicate that new attack vectors have been opened up in the AWS account.


Detection logic:
{
  "selection": {
    "eventSource": "ec2.amazonaws.com",
    "eventName": "CreateNetworkAclEntry"
  },
  "condition": "selection"
}

References:
  - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/
Sigma Detection Rule: AWS New Lambda Layer Attached
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Austin Songer
Date: 2021-09-23
Log source: aws/

Description:
Detects when a user attached a Lambda layer to an existing Lambda function.
A malicious Lambda layer could execute arbitrary code in the context of the function's IAM role.
This would give an adversary access to resources that the function has access to.


Detection logic:
{
  "selection": {
    "eventSource": "lambda.amazonaws.com",
    "eventName|startswith": "UpdateFunctionConfiguration",
    "requestParameters.layers|contains": "*"
  },
  "condition": "selection"
}

References:
  - https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateFunctionConfiguration.html
  - https://github.com/clearvector/lambda-spy
Sigma Detection Rule: AWS CloudTrail Important Change
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: vitaliy0x1
Date: 2020-01-21
ATT&CK techniques: T1685.002
Log source: aws/

Description:
Detects disabling, deleting and updating of a Trail

Detection logic:
{
  "selection_source": {
    "eventSource": "cloudtrail.amazonaws.com",
    "eventName": [
      "StopLogging",
      "UpdateTrail",
      "DeleteTrail"
    ]
  },
  "condition": "selection_source"
}

References:
  - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html
Sigma Detection Rule: Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: jamesc-grafana
Date: 2024-07-11
ATT&CK techniques: T1078, T1078.002
Log source: aws/

Description:
Detects when an instance identity has taken an action that isn't inside SSM.
This can indicate that a compromised EC2 instance is being used as a pivot point.


Detection logic:
{
  "selection": {
    "userIdentity.arn|re": ".+:assumed-role/aws:.+"
  },
  "filter_main_generic": [
    {
      "eventSource": "ssm.amazonaws.com"
    },
    {
      "eventName": "RegisterManagedInstance"
    },
    {
      "sourceIPAddress": "AWS Internal"
    }
  ],
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-identity-roles.html
  - https://ermetic.com/blog/aws/aws-ec2-imds-what-you-need-to-know/
  - https://www.packetmischief.ca/2023/07/31/amazon-ec2-credential-exfiltration-how-it-happens-and-how-to-mitigate-it/#lifting-credentials-from-imds-this-is-why-we-cant-have-nice-things