deardaniel/secdata-raw huggingface dataset:
Elastic SIEM Detection Rules: iam customer managed policies attached to existing roles

# AWS IAM Customer-Managed Policy Attachment to Existing Roles

---

## Metadata

- **Author:** Elastic
- **Description:** This hunting query identifies instances where customer-managed IAM policies are attached to existing roles, potentially indicating a privilege escalation attempt. By detecting unexpected actors attaching customer-managed policies with elevated permissions to roles, this query helps identify potential abuse or misuse within AWS. Adversaries may attach these policies to gain unauthorized permissions or enable lateral movement and persistence within the environment.

- **UUID:** `418baaf2-9ae1-11ef-be63-f661ea17fbcd`
- **Integration:** [aws.cloudtrail](https://docs.elastic.co/integrations/aws/cloudtrail)
- **Language:** `[ES|QL]`
- **Source File:** [AWS IAM Customer-Managed Policy Attachment to Existing Roles](../queries/iam_customer_managed_policies_attached_to_existing_roles.toml)

## Query

```sql
from logs-aws.cloudtrail*
| where
    event.dataset == "aws.cloudtrail"
    and event.provider == "iam.amazonaws.com"
    and event.action == "AttachRolePolicy"
    and event.outcome == "success"
| dissect aws.cloudtrail.request_parameters "{%{}::%{owner}:%{?policy_key}/%{attached_policy_name}, %{?role_name_key}=%{target_role_name}}"
| where owner != "aws"
| stats
    actor_attaching_role_count = count(*) by aws.cloudtrail.user_identity.arn, attached_policy_name, target_role_name
```

## Notes

- Review the `attached_policy_name` and `target_role_name` fields to identify the customer-managed policy and role involved in the attachment.
- Review the permissions of the attached policy to determine the potential impact of the privilege escalation attempt.
- Review all entities that `target_role_name` may be attached to as these entities may have been compromised or misused.
- Consider reviewing the `aws.cloudtrail.user_identity.arn` field to identify the actor responsible for the privilege escalation attempt.
- Review the user agent of the actor to determine the source of the privilege escalation attempt, such as an AWS CLI or SDK.

## MITRE ATT&CK Techniques

- [T1548.005](https://attack.mitre.org/techniques/T1548/005)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: iam assume role creation with attached policy

# IAM Assume Role Creation with Attached Policy

---

## Metadata

- **Author:** Elastic
- **Description:** This hunting query gathers data for evidence of an adversary creating an IAM role with an inline attached policy that allows the role to assume another role. This only identifies flags for AWS account IDs that are different from the account ID where the role is being created indicating a potential backdoor IAM role.

- **UUID:** `429824b6-60b2-11ef-b0a4-f661ea17fbce`
- **Integration:** [aws.cloudtrail](https://docs.elastic.co/integrations/aws/cloudtrail)
- **Language:** `[ES|QL]`
- **Source File:** [IAM Assume Role Creation with Attached Policy](../queries/iam_assume_role_creation_with_attached_policy.toml)

## Query

```sql
from logs-aws.cloudtrail-*
| where @timestamp > now() - 7 day
| where
    event.provider == "iam.amazonaws.com"
    and event.action == "CreateRole"
    and aws.cloudtrail.request_parameters RLIKE ".*Allow.*"
    and aws.cloudtrail.request_parameters RLIKE ".*sts:AssumeRole.*"
    and aws.cloudtrail.request_parameters RLIKE ".*assumeRolePolicyDocument.*"
    and aws.cloudtrail.request_parameters RLIKE ".*arn:aws:iam.*"
| dissect aws.cloudtrail.request_parameters "%{}AWS\": \"arn:aws:iam::%{target_account_id}:"
| where cloud.account.id != target_account_id
| keep @timestamp, event.provider, event.action, aws.cloudtrail.request_parameters, target_account_id, cloud.account.id
```

## Notes

- Review the `target_account_id` field to identify the account that the role is being created in. This could be another AWS account your organization owns.
- Review `aws.cloudtrail.request_parameters` to identify the role being created and the policy being attached. If the inline policy includes overly permissive permissions such as `AdministratorAccess`, this could be a sign of malicious activity.
- Pivot for `event.action` where the value is `AttachRolePolicy` to identify the policy being attached to the role.

## MITRE ATT&CK Techniques

- [T1098.003](https://attack.mitre.org/techniques/T1098/003)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: sts suspicious federated temporary credential request

# STS Suspicious Federated Temporary Credential Request

---

## Metadata

- **Author:** Elastic
- **Description:** This hunting query identifies when a user requests temporary federated credentials with a duration greater than 24 hours or with the `AdministratorAccess` policy attached. Federated users are typically given temporary credentials to access AWS services. A duration greater than 24 hours or the `AdministratorAccess` policy attached may indicate an adversary attempting to maintain access to AWS services for an extended period of time or escalate privileges.

- **UUID:** `3f8393b2-5f0b-11ef-8a25-f661ea17fbce`
- **Integration:** [aws.cloudtrail](https://docs.elastic.co/integrations/aws/cloudtrail)
- **Language:** `[ES|QL]`
- **Source File:** [STS Suspicious Federated Temporary Credential Request](../queries/sts_suspicious_federated_temporary_credential_request.toml)

## Query

```sql
from logs-aws.cloudtrail-*
| where @timestamp > now() - 7 day
| where
    event.dataset == "aws.cloudtrail"
    and event.provider == "sts.amazonaws.com"
    and event.action == "GetFederationToken"
| dissect aws.cloudtrail.request_parameters "{%{}name=%{user_name},"
| dissect aws.cloudtrail.request_parameters "{%{}durationSeconds=%{duration_requested},"
| dissect aws.cloudtrail.request_parameters "{%{}policyArns=[%{policies_applied}]"
| eval duration_minutes = to_integer(duration_requested) / 60
| where (duration_minutes > 1440) or (policies_applied RLIKE ".*AdministratorAccess.*")
| keep @timestamp, event.dataset, event.provider, event.action, aws.cloudtrail.request_parameters, user_name, duration_requested, duration_minutes, policies_applied
```

## Notes

- If the `aws.cloudtrail.user_identity.arn` does not match the `user_name` field, this may indicate an adversary attempting to escalate privileges by requesting temporary credentials for a different user.
- Review `event.outcome` field to identify if the request was successful or failed.
- The `aws.cloudtrail.user_identity.session_context.session_issuer.arn` field represents the ARN of the IAM entity that created the federated session. This IAM entity could be compromised and used to create federated sessions. This could indicate the compromised credentials or role used to create the federated session.
- An additional query for `event.provider` being `signin.amazonaws.com` and `event.action` being `GetSigninToken` can be used to identify if the temporary credentials are being exchanged for console access.

## MITRE ATT&CK Techniques

- [T1550.001](https://attack.mitre.org/techniques/T1550/001)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: ec2 modify instance attribute user data

# EC2 Modify Instance Attribute User Data

---

## Metadata

- **Author:** Elastic
- **Description:** This hunting query identifies when a user modifies the user data attribute of an EC2 instance. The user data attribute is a script that runs when the instance is launched. Modifying the user data attribute could indicate an adversary attempting to gain persistence or execute malicious code on the instance.

- **UUID:** `f11ac62c-5f42-11ef-9d72-f661ea17fbce`
- **Integration:** [aws.cloudtrail](https://docs.elastic.co/integrations/aws/cloudtrail)
- **Language:** `[ES|QL]`
- **Source File:** [EC2 Modify Instance Attribute User Data](../queries/ec2_modify_instance_attribute_user_data.toml)

## Query

```sql
from logs-aws.cloudtrail-*
| where @timestamp > now() - 7 day
| where
    event.provider == "ec2.amazonaws.com"
    and event.action == "ModifyInstanceAttribute"
    and aws.cloudtrail.request_parameters RLIKE ".*attribute=userData.*"
| dissect aws.cloudtrail.request_parameters "{%{instance_id_key}=%{instance_id}, %{attribute_key}=%{attribute}, %{value_key}=%{value}}"
| stats user_attribute_modify_count = count(*) by aws.cloudtrail.user_identity.arn, event.outcome
```

## Notes

- Use the `instance_id` field to identify the EC2 instance for which the user data attribute was modified
- Pivot into the EC2 instance if possible and examine the user data script ('/var/lib/cloud/instance/scripts/userdata.txt') for malicious content
- To modify an EC2 instance's user data attribute, the instance must be stopped, therefore check for `StopInstances` API calls in `event.action` field to determine if the instance was stopped and started
- AWS redacts the value of the `user_data` attribute in the CloudTrail logs, so the actual script content will not be visible in the logs

## MITRE ATT&CK Techniques

- [T1059.009](https://attack.mitre.org/techniques/T1059/009)
- [T1037](https://attack.mitre.org/techniques/T1037)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: iam unusual default aviatrix role activity

# IAM Unusual Default Aviatrix Role Activity

---

## Metadata

- **Author:** Elastic
- **Description:** This hunting query identifies unusual activity related to the default Aviatrix role in AWS CloudTrail logs. The Aviatrix role is a default role created by the Aviatrix Controller to manage AWS resources. Unusual activity may indicate unauthorized access or misuse of the Aviatrix role, potentially leading to data exfiltration, privilege escalation, or other security incidents.

- **UUID:** `9fe48b6e-d83a-11ef-84a6-f661ea17fbcd`
- **Integration:** [aws.cloudtrail](https://docs.elastic.co/integrations/aws/cloudtrail)
- **Language:** `[ES|QL]`
- **Source File:** [IAM Unusual Default Aviatrix Role Activity](../queries/iam_unusual_default_aviatrix_role_activity.toml)

## Query

```sql
from logs-aws.cloudtrail-*
| where @timestamp > now() - 14 day
| where event.dataset == "aws.cloudtrail"
    and aws.cloudtrail.user_identity.type == "AssumedRole"
    and aws.cloudtrail.user_identity.arn like "*aviatrix-role*"
| stats activity_counts = count(*) by event.provider, event.action, aws.cloudtrail.user_identity.arn
| where activity_counts < 10
| sort activity_counts asc
```

## Notes

- Review the `aws.cloudtrail.user_identity.arn` field to identify the Aviatrix role.
- Review the `aws.cloudtrail.resources.arn` field to identify the EC2 instance associated with the activity.
- Review security group and network ACL configurations for the EC2 instance to ensure they are not overly permissive or allow unauthorized access.
- Using the EC2 instance, pivot into VPC Flow Logs to identify network traffic patterns and potential lateral movement.
- Review if the controller was recently deployed or updated, as this may explain unusual activity related to the Aviatrix role.
- If available, review endpoint logs for the Aviatrix Controller to identify any aviatrix processes that have made unusual requests or system calls.

## MITRE ATT&CK Techniques

- [T1078.004](https://attack.mitre.org/techniques/T1078/004)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: sns topic created by rare user

# SNS Topic Created by Rare User

---

## Metadata

- **Author:** Elastic
- **Description:** This hunting query gathers evidence of an SNS topic created by a user who does not typically perform this action. Adversaries may create SNS topics to stage capabilities for data exfiltration or other malicious activities.

- **UUID:** `80955fb2-e952-11ef-b7cc-f661ea17fbce`
- **Integration:** [aws.cloudtrail](https://docs.elastic.co/integrations/aws/cloudtrail)
- **Language:** `[ES|QL]`
- **Source File:** [SNS Topic Created by Rare User](../queries/sns_topic_created_by_rare_user.toml)

## Query

```sql
from logs-aws.cloudtrail-*
| WHERE @timestamp > now() - 7 day
| WHERE
    event.dataset == "aws.cloudtrail" AND
    event.provider == "sns.amazonaws.com" AND
    event.action == "CreateTopic"
    and aws.cloudtrail.user_identity.type == "AssumedRole"
| DISSECT aws.cloudtrail.request_parameters "{%{?topic_name_key}=%{topic_name}}"
| DISSECT aws.cloudtrail.user_identity.arn "%{?}:assumed-role/%{assumed_role_name}/%{entity}"
| DISSECT user_agent.original "%{user_agent_name} %{?user_agent_remainder}"
| WHERE STARTS_WITH(entity, "i-")
| KEEP cloud.account.id, entity, assumed_role_name, cloud.region, user_agent_name
| STATS regional_topic_created_count = COUNT(*) by cloud.account.id, entity, assumed_role_name, cloud.region, user_agent_name
| SORT regional_topic_created_count ASC
```

## Notes

- It is unusual for credentials from an assumed role for an EC2 instance to be creating SNS topics randomly.
- If a user identity access key (`aws.cloudtrail.user_identity.access_key_id`) exists in the CloudTrail audit log, then this request was accomplished via the CLI or programmatically. These keys could be compromised and warrant further investigation.
- Pivot into `Publish` API actions being called to this specific topic to identify which AWS resource is publishing messages. With access to the topic, you could further investigate the subscribers list to identify unauthorized subscribers.

## MITRE ATT&CK Techniques

- [T1608](https://attack.mitre.org/techniques/T1608)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: ec2 discovery multi region describe instance calls

# High Frequency of EC2 Multi-Region `DescribeInstances` API Calls

---

## Metadata

- **Author:** Elastic
- **Description:** This hunting query identifies when a user makes multiple `DescribeInstances` API calls in multiple regions within a 30-second window. The `DescribeInstances` API call retrieves information about one or more EC2 instances in a region. High frequency of `DescribeInstances` API calls across multiple regions may indicate an adversary attempting to discover the EC2 instances in the account or perform reconnaissance on the EC2 environment.

- **UUID:** `e6e78858-6482-11ef-93bd-f661ea17fbcc`
- **Integration:** [aws.cloudtrail](https://docs.elastic.co/integrations/aws/cloudtrail)
- **Language:** `[ES|QL]`
- **Source File:** [High Frequency of EC2 Multi-Region `DescribeInstances` API Calls](../queries/ec2_discovery_multi_region_describe_instance_calls.toml)

## Query

```sql
from logs-aws.cloudtrail-*
| where @timestamp > now() - 7 day

// filter for DescribeInstances API calls
| where event.dataset == "aws.cloudtrail" and event.provider == "ec2.amazonaws.com" and event.action == "DescribeInstances"

// truncate the timestamp to a 30-second window
| eval target_time_window = DATE_TRUNC(30 seconds, @timestamp)

// count the number of unique regions and total API calls within the 30-second window
| stats region_count = count_distinct(cloud.region), window_count = count(*) by target_time_window, aws.cloudtrail.user_identity.arn

// filter for resources making DescribeInstances API calls in more than 10 regions within the 30-second window
| where region_count >= 10 and window_count >= 10

// sort the results by time windows in descending order
| sort target_time_window desc
```

## Notes

- Use the `aws.cloudtrail.user_identity.arn` field to identify the user making the requests and their role permissions
- Use the `cloud.region` field to identify the regions where the `DescribeInstances` API calls were made
- If leveraging SSM, query for `StartSession` API calls to determine if the user is attempting to establish a session with the EC2 instances
- Filter for `event.provider` is `ec2.amazonaws.com` to pivot on unusual activity related to EC2 instances

## MITRE ATT&CK Techniques

- [T1580](https://attack.mitre.org/techniques/T1580)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: secretsmanager high frequency get secret value

# Secrets Manager High Frequency of Programmatic GetSecretValue API Calls

---

## Metadata

- **Author:** Elastic
- **Description:** This hunting query identifies when a high frequency of `GetSecretValue` API calls are made to the AWS Secrets Manager service programmatically. The `GetSecretValue` API call retrieves the secret value for a specified secret. High frequency of these calls may indicate an adversary attempting to access sensitive information stored in AWS Secrets Manager via a compromised account or automated tooling.

- **UUID:** `ef244ca0-5e32-11ef-a8d3-f661ea17fbce`
- **Integration:** [aws.cloudtrail](https://docs.elastic.co/integrations/aws/cloudtrail)
- **Language:** `[ES|QL]`
- **Source File:** [Secrets Manager High Frequency of Programmatic GetSecretValue API Calls](../queries/secretsmanager_high_frequency_get_secret_value.toml)

## Query

```sql
from logs-aws.cloudtrail*
| where @timestamp > now() - 7 day
| where
    event.provider == "secretsmanager.amazonaws.com"
    and event.action == "GetSecretValue"
    and user_agent.name not in ("Chrome","Firefox","Safari", "Edge", "Brave", "Opera")
| dissect aws.cloudtrail.request_parameters "%{}secret:%{secret_value}}"
| stats request_counts = count(*) by event.action, aws.cloudtrail.user_identity.arn, source.ip, user_agent.name
| sort request_counts asc
```

## Notes

- Use the `secret_value` field to identify the secret value that was accessed by adding it to the `stats` statement
- Review the `aws.cloudtrail.user_identity*` fields to identify the user making the requests and their role permissions
- `user_agent.name` field can provide additional context on the tool or application making the API calls. If not `aws-sdk` or known application, investigate further.
- Review the `source.*` fields for the IP address and geographical location of the request and compare with the user's typical behavior
- The `aws.cloudtrail.user_identity.arn` field can provide additional context on the user making the request and their role permissions. Recent changes to role permissions or unusual logins may indicate a compromised account
- `user_agent.name` field can provide additional context on the tool or application making the API calls. If not `aws-sdk` or known application, investigate further.

## MITRE ATT&CK Techniques

- [T1555.006](https://attack.mitre.org/techniques/T1555/006)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: sns email subscription by rare user

# SNS Topic Subscription with Email by Rare User

---

## Metadata

- **Author:** Elastic
- **Description:** This hunting query gathered evidence of an SNS topic subscribed to by an email address of a user who does not typically perform this action. Adversaries may subscribe to SNS topics to collect sensitive information or exfiltrate data via an external email address.

- **UUID:** `fb752e42-e952-11ef-85e7-f661ea17fbce`
- **Integration:** [aws.cloudtrail](https://docs.elastic.co/integrations/aws/cloudtrail)
- **Language:** `[ES|QL]`
- **Source File:** [SNS Topic Subscription with Email by Rare User](../queries/sns_email_subscription_by_rare_user.toml)

## Query

```sql
from logs-aws.cloudtrail-*
| where @timestamp > now() - 7 day
| WHERE
    event.dataset == "aws.cloudtrail" AND
    event.provider == "sns.amazonaws.com" AND
    event.action == "Subscribe"
| DISSECT aws.cloudtrail.request_parameters "%{?protocol_key}=%{protocol}, %{?endpoint_key}=%{redacted}, %{?return_arn}=%{return_bool}, %{?topic_arn_key}=%{topic_arn}}"
| DISSECT user_agent.original "%{user_agent_name} %{?user_agent_remainder}"
| WHERE protocol == "email"
| KEEP cloud.region, source.address, aws.cloudtrail.user_identity.arn, user_agent_name
| STATS regional_topic_subscription_count = COUNT(*) by aws.cloudtrail.user_identity.arn, cloud.region, source.address, user_agent_name
| WHERE regional_topic_subscription_count == 1
| SORT regional_topic_subscription_count ASC
```

## Notes

- If a user identity access key (aws.cloudtrail.user_identity.access_key_id) exists in the CloudTrail audit log, then this request was accomplished via the CLI or programmatically. These keys could be compromised and warrant further investigation.
- Ignoring the topic ARN during aggregation is important to identify first occurrence anomalies of subscribing to SNS topic with an email.
- Another query may be required with the user identity arn as an inclusion filter to identify which topic they subscribed to.

## MITRE ATT&CK Techniques

- [T1567](https://attack.mitre.org/techniques/T1567)
- [T1530](https://attack.mitre.org/techniques/T1530)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: sns topic message published by rare user

# SNS Topic Message Published by Rare User

---

## Metadata

- **Author:** Elastic
- **Description:** This hunting query gathers evidence of an SNS topic message published by a user who does not typically perform this action. Adversaries may publish messages to SNS topics to stage capabilities for data exfiltration or other malicious activities.

- **UUID:** `db405900-e955-11ef-8c29-f661ea17fbce`
- **Integration:** [aws.cloudtrail](https://docs.elastic.co/integrations/aws/cloudtrail)
- **Language:** `[ES|QL]`
- **Source File:** [SNS Topic Message Published by Rare User](../queries/sns_topic_message_published_by_rare_user.toml)

## Query

```sql
from logs-aws.cloudtrail-*
| where @timestamp > now() - 7 day
| WHERE
    event.dataset == "aws.cloudtrail" AND
    event.provider == "sns.amazonaws.com" AND
    event.action == "Publish"
    and aws.cloudtrail.user_identity.type == "AssumedRole"
| DISSECT aws.cloudtrail.request_parameters "{%{?message_key}=%{message}, %{?topic_key}=%{topic_arn}}"
| DISSECT aws.cloudtrail.user_identity.arn "%{?}:assumed-role/%{assumed_role_name}/%{entity}"
| DISSECT user_agent.original "%{user_agent_name} %{?user_agent_remainder}"
| WHERE STARTS_WITH(entity, "i-")
| KEEP cloud.account.id, entity, assumed_role_name, topic_arn, cloud.region, user_agent_name
| STATS regional_topic_publish_count = COUNT(*) by cloud.account.id, entity, assumed_role_name, topic_arn, cloud.region, user_agent_name
| SORT regional_topic_publish_count ASC
```

## Notes

- If a user identity access key (`aws.cloudtrail.user_identity.access_key_id`) exists in the CloudTrail audit log, then this request was accomplished via the CLI or programmatically. These keys could be compromised and warrant further investigation.
- If you notice Terraform, Pulumi, etc. it may be related to testing environments, maintenance or more.
- Python SDKs that are not AWS, may indicate custom tooling or scripts being leveraged.

## MITRE ATT&CK Techniques

- [T1567](https://attack.mitre.org/techniques/T1567)
- [T1566.003](https://attack.mitre.org/techniques/T1566/003)

## License

- `Elastic License v2`