Skip to content

Commit

Permalink
[New Rule] AWS STS AssumeRole with New MFA Device [Rule Tuning] AWS I…
Browse files Browse the repository at this point in the history
…AM Deactivation of MFA Device (#4210)

* [New Rule] [Rule Tuning] AWS STS AssumeRole with New MFA Device, AWS IAM Deactivation of MFA Device

New terms rule for new MFA device with AssumeRole action. Rule tuning to add MITRE technique to "AWS IAM Deactivation of MFA Device"

* add serialNumber to non-ecs schema file

* fixed misspelled toml file name

* Update rules/integrations/aws/persistence_sts_assume_role_with_new_mfa.toml

Co-authored-by: Ruben Groenewoud <[email protected]>

---------

Co-authored-by: Ruben Groenewoud <[email protected]>

(cherry picked from commit 09ea35f)
  • Loading branch information
imays11 authored and github-actions[bot] committed Nov 5, 2024
1 parent 9f16bc5 commit 69a8e68
Show file tree
Hide file tree
Showing 3 changed files with 125 additions and 2 deletions.
3 changes: 2 additions & 1 deletion detection_rules/etc/non-ecs-schema.json
Original file line number Diff line number Diff line change
Expand Up @@ -150,7 +150,8 @@
"logs-aws.cloudtrail-*": {
"aws.cloudtrail.flattened.request_parameters.cidrIp": "keyword",
"aws.cloudtrail.flattened.request_parameters.fromPort": "keyword",
"aws.cloudtrail.flattened.request_parameters.roleArn": "keyword"
"aws.cloudtrail.flattened.request_parameters.roleArn": "keyword",
"aws.cloudtrail.flattened.request_parameters.serialNumber": "keyword"
},
"logs-azure.signinlogs-*": {
"azure.signinlogs.properties.conditional_access_audiences.application_id": "keyword"
Expand Down
18 changes: 17 additions & 1 deletion rules/integrations/aws/impact_iam_deactivate_mfa_device.toml
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2020/05/26"
integration = ["aws"]
maturity = "production"
updated_date = "2024/05/21"
updated_date = "2024/10/25"

[rule]
author = ["Elastic", "Austin Songer"]
Expand Down Expand Up @@ -80,6 +80,7 @@ tags = [
"Data Source: AWS IAM",
"Resources: Investigation Guide",
"Tactic: Impact",
"Tactic: Persistence",
]
timestamp_override = "event.ingested"
type = "query"
Expand All @@ -101,4 +102,19 @@ reference = "https://attack.mitre.org/techniques/T1531/"
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1556"
name = "Modify Authentication Process"
reference = "https://attack.mitre.org/techniques/T1556/"
[[rule.threat.technique.subtechnique]]
id = "T1556.006"
name = "Multi-Factor Authentication"
reference = "https://attack.mitre.org/techniques/T1556/006/"


[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
106 changes: 106 additions & 0 deletions rules/integrations/aws/persistence_sts_assume_role_with_new_mfa.toml
Original file line number Diff line number Diff line change
@@ -0,0 +1,106 @@
[metadata]
creation_date = "2024/10/25"
integration = ["aws"]
maturity = "production"
updated_date = "2024/10/25"


[rule]
author = ["Elastic"]
description = """
Identifies when a user has assumed a role using a new MFA device. Users can assume a role to obtain temporary credentials and access AWS resources using the AssumeRole API of AWS Security Token Service (STS).
While a new MFA device is not always indicative of malicious behavior it should be verified as adversaries can use this technique for persistence and privilege escalation.
"""
false_positives = [
"AWS administrators or automated processes might regularly assume roles for legitimate administrative purposes and to perform periodic tasks such as data backups, updates, or deployments.",
]
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS STS AssumeRole with New MFA Device"
note = """## Setup
The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
references = [
"https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html",
"https://github.com/RhinoSecurityLabs/cloudgoat/blob/d5863b80afd082d853f2e8df1955c6393695a4da/scenarios/iam_privesc_by_key_rotation/README.md",
]
risk_score = 21
rule_id = "a22f566b-5b23-4412-880d-c6c957acd321"
severity = "low"
tags = [
"Domain: Cloud",
"Data Source: AWS",
"Data Source: Amazon Web Services",
"Data Source: AWS STS",
"Use Case: Identity and Access Audit",
"Tactic: Privilege Escalation",
"Tactic: Persistence",
"Tactic: Lateral Movement",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
event.dataset:aws.cloudtrail
and event.provider:sts.amazonaws.com
and event.action:(AssumeRole or AssumeRoleWithSAML or AssumeRoleWithWebIdentity)
and event.outcome:success
and user.id:*
and aws.cloudtrail.flattened.request_parameters.serialNumber:*
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1556"
name = "Modify Authentication Process"
reference = "https://attack.mitre.org/techniques/T1556/"
[[rule.threat.technique.subtechnique]]
id = "T1556.006"
name = "Multi-Factor Authentication"
reference = "https://attack.mitre.org/techniques/T1556/006/"


[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1548"
name = "Abuse Elevation Control Mechanism"
reference = "https://attack.mitre.org/techniques/T1548/"


[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1550"
name = "Use Alternate Authentication Material"
reference = "https://attack.mitre.org/techniques/T1550/"
[[rule.threat.technique.subtechnique]]
id = "T1550.001"
name = "Application Access Token"
reference = "https://attack.mitre.org/techniques/T1550/001/"


[rule.threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"

[rule.new_terms]
field = "new_terms_fields"
value = ["user.id", "aws.cloudtrail.flattened.request_parameters.serialNumber"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-10d"


0 comments on commit 69a8e68

Please sign in to comment.