{"id":"352a918a-34d8-4882-8470-44830c507aa3","title":"Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure","description":"Detects when an instance identity has taken an action that isn't inside SSM.\nThis can indicate that a compromised EC2 instance is being used as a pivot point.\n","author":"jamesc-grafana","status":"test","level":"high","date":"2024-07-11","modified":"","tags":["attack.privilege-escalation","attack.initial-access","attack.persistence","attack.stealth","attack.t1078","attack.t1078.002"],"technique_ids":["T1078","T1078.002"],"logsource":{"product":"aws","service":"cloudtrail"},"falsepositives":["A team has configured an EC2 instance to use instance profiles that grant the option for the EC2 instance to talk to other AWS Services"],"references":["https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-identity-roles.html","https://ermetic.com/blog/aws/aws-ec2-imds-what-you-need-to-know/","https://www.packetmischief.ca/2023/07/31/amazon-ec2-credential-exfiltration-how-it-happens-and-how-to-mitigate-it/#lifting-credentials-from-imds-this-is-why-we-cant-have-nice-things"],"source_path":"rules/cloud/aws/cloudtrail/aws_cloudtrail_imds_malicious_usage.yml","source_sha256":"b070399db57d212727d7f7873c642a0c1da0930c2b45a5fe8945c3e2474caf37","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_cloudtrail_imds_malicious_usage.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure\nid: 352a918a-34d8-4882-8470-44830c507aa3\nstatus: test\ndescription: |\n    Detects when an instance identity has taken an action that isn't inside SSM.\n    This can indicate that a compromised EC2 instance is being used as a pivot point.\nreferences:\n    - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-identity-roles.html\n    - https://ermetic.com/blog/aws/aws-ec2-imds-what-you-need-to-know/\n    - https://www.packetmischief.ca/2023/07/31/amazon-ec2-credential-exfiltration-how-it-happens-and-how-to-mitigate-it/#lifting-credentials-from-imds-this-is-why-we-cant-have-nice-things\nauthor: jamesc-grafana\ndate: 2024-07-11\ntags:\n    - attack.privilege-escalation\n    - attack.initial-access\n    - attack.persistence\n    - attack.stealth\n    - attack.t1078\n    - attack.t1078.002\nlogsource:\n    product: aws\n    service: cloudtrail\ndetection:\n    selection:\n        userIdentity.arn|re: '.+:assumed-role/aws:.+'\n    filter_main_generic:\n        - eventSource: 'ssm.amazonaws.com'\n        - eventName: 'RegisterManagedInstance'\n        - sourceIPAddress: 'AWS Internal'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - A team has configured an EC2 instance to use instance profiles that grant the option for the EC2 instance to talk to other AWS Services\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1078","id":"T1078","name":"Valid Accounts","page":"techniques/enterprise/T1078/"},{"key":"enterprise/T1078.002","id":"T1078.002","name":"Domain Accounts","page":"techniques/enterprise/T1078.002/"}],"data_path":"data/detection-rules/352a918a-34d8-4882-8470-44830c507aa3.json","kind":"sigma"}