Isai e22f60f44c [Tuning] AWS IAM Create User via Assumed Role on EC2 Instance (#5063) ...

- query change : I chose to replace `aws.cloudtrail.user_identity.arn` with `user.id` and a more accurate wildcard pattern. This will reduce the chances of this rule triggering for role sessions outside of those started by EC2 instances. The wildcard pattern looks for a role session name that starts with `i-` this is because when an EC2 instance operates using it's attached Role (instance profile), the session name attached to that role name is the instance id (`i-......`). The `user.id` field appends this session name to the role name via a standard pattern `:[session_name]`, making it a more reliable field to use in this case.
- small edits to description and IG
- reduced execution window
- reduced history window
- edited highlighted fields
Note: the new_terms field here remains `aws.cloudtrail.user_identity.arn` because we are only interested in assumed roles, and even more particular, only those used by an EC2 instance. This means we want to evaluate each individual instance's behavior rather than the broader behavior of the role itself. The arn field will capture each instance id (session name) alongside the role itself.

2025-09-11 15:11:40 -04:00

..

collection_cloudtrail_logging_created.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

collection_s3_unauthenticated_bucket_access_by_rare_source.toml

[FR] Add Remaining Guides (#4412)

2025-01-22 14:43:30 -06:00

credential_access_aws_getpassword_for_ec2_instance.toml

[Rule Tuning] AWS EC2 Unauthorized Admin Credential Fetch via Assumed Role (#4774)

2025-06-06 15:08:48 -04:00

credential_access_aws_iam_assume_role_brute_force.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

credential_access_iam_compromisedkeyquarantine_policy_attached_to_user.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

credential_access_iam_user_addition_to_group.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

credential_access_new_terms_secretsmanager_getsecretvalue.toml

[Rule Tuning] First Time Seen AWS Secret Value Accessed in Secrets Manager (#4992)

2025-08-25 12:00:47 -04:00

credential_access_rapid_secret_retrieval_attempts_from_secretsmanager.toml

Replace master doc URLs with current (#4439)

2025-02-03 21:27:50 +05:30

credential_access_retrieve_secure_string_parameters_via_ssm.toml

[Rule Tunings] Reduce Usage of Flattened Fields in AWS Rules (#4892)

2025-07-18 19:15:36 -04:00

credential_access_root_console_failure_brute_force.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_cloudtrail_logging_deleted.toml

[Rule Tuning] Add Investigation Fields to Specific AWS Rules (#4261)

2024-11-08 23:11:18 -05:00

defense_evasion_cloudtrail_logging_evasion.toml

[New Rule] AWS CloudTrail Log Evasion (#4788)

2025-06-17 13:58:26 -04:00

defense_evasion_cloudtrail_logging_suspended.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_cloudwatch_alarm_deletion.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_config_service_rule_deletion.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_configuration_recorder_stopped.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_ec2_flow_log_deletion.toml

[Rule Tunings] AWS EC2 Flow Log Deletion and Network ACL Activity (#4778)

2025-06-06 14:11:54 -04:00

defense_evasion_ec2_network_acl_deletion.toml

[Rule Tunings] AWS EC2 Flow Log Deletion and Network ACL Activity (#4778)

2025-06-06 14:11:54 -04:00

defense_evasion_elasticache_security_group_creation.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_elasticache_security_group_modified_or_deleted.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_guardduty_detector_deletion.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_rds_instance_restored.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_route53_dns_query_resolver_config_deletion.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_s3_bucket_configuration_deletion.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_s3_bucket_lifecycle_expiration_added.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_s3_bucket_server_access_logging_disabled.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_sqs_purge_queue.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_sts_get_federation_token.toml

[Tuning] First Occurrence of STS GetFederationToken Request by User (#5007)

2025-08-29 13:08:59 -04:00

defense_evasion_vpc_security_group_ingress_rule_added_for_remote_connections.toml

[Rule Tunings] Reduce Usage of Flattened Fields in AWS Rules (#4892)

2025-07-18 19:15:36 -04:00

defense_evasion_waf_acl_deletion.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_waf_rule_or_rule_group_deletion.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

discovery_ec2_deprecated_ami_discovery.toml

[Rule Tunings] Reduce Usage of Flattened Fields in AWS Rules (#4892)

2025-07-18 19:15:36 -04:00

discovery_ec2_multi_region_describe_instances.toml

[Rule Tuning] ESQL Query Field Dynamic Field Standardization (#4912)

2025-08-05 19:35:41 -04:00

discovery_ec2_multiple_discovery_api_calls_via_cli.toml

[Rule Tuning] ESQL Query Field Dynamic Field Standardization (#4912)

2025-08-05 19:35:41 -04:00

discovery_ec2_userdata_request_for_ec2_instance.toml

[Rule Tunings] Reduce Usage of Flattened Fields in AWS Rules (#4892)

2025-07-18 19:15:36 -04:00

discovery_new_terms_sts_getcalleridentity.toml

[Rule Tuning] AWS STS GetCallerIdentity API Called for the First Time (#4995)

2025-08-25 11:44:58 -04:00

discovery_servicequotas_multi_region_service_quota_requests.toml

[Rule Tuning] ESQL Query Field Dynamic Field Standardization (#4912)

2025-08-05 19:35:41 -04:00

execution_lambda_external_layer_added_to_function.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

execution_new_terms_cloudformation_createstack.toml

[Tuning] First Time AWS Cloudformation Stack Creation by User (#5036)

2025-08-29 12:36:21 -04:00

execution_ssm_command_document_created_by_rare_user.toml

[Rule Tunings] AWS SSM Command Document Created by Rare User (#4848)

2025-06-27 13:24:27 -04:00

execution_ssm_sendcommand_by_rare_user.toml

[Rule Tunings] Reduce Usage of Flattened Fields in AWS Rules (#4892)

2025-07-18 19:15:36 -04:00

exfiltration_dynamodb_scan_by_unusual_user.toml

[New Rule] Adding Coverage for DynamoDB Exfiltration Behaviors (#4535)

2025-03-21 10:05:24 -04:00

exfiltration_dynamodb_table_exported_to_s3.toml

[Rule Tunings] Reduce Usage of Flattened Fields in AWS Rules (#4892)

2025-07-18 19:15:36 -04:00

exfiltration_ec2_ami_shared_with_separate_account.toml

[Rule Tuning] AWS EC2 AMI Shared with Another Account (#4914)

2025-07-21 10:12:13 +05:30

exfiltration_ec2_ebs_snapshot_shared_with_another_account.toml

[Rule Tuning] ESQL Query Field Dynamic Field Standardization (#4912)

2025-08-05 19:35:41 -04:00

exfiltration_ec2_full_network_packet_capture_detected.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

exfiltration_ec2_vm_export_failure.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

exfiltration_rds_snapshot_export.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

exfiltration_rds_snapshot_shared_with_another_account.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

exfiltration_s3_bucket_policy_added_for_external_account_access.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

exfiltration_s3_bucket_replicated_to_external_account.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

exfiltration_sns_email_subscription_by_rare_user.toml

[New Hunt] Adding Hunting Queries for AWS SNS exfiltration and data collection (#4458)

2025-02-20 10:53:36 -05:00

impact_aws_eventbridge_rule_disabled_or_deleted.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

impact_aws_s3_bucket_enumeration_or_brute_force.toml

[Rule Tuning] ESQL Query Field Dynamic Field Standardization (#4912)

2025-08-05 19:35:41 -04:00

impact_cloudtrail_logging_updated.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

impact_cloudwatch_log_group_deletion.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

impact_cloudwatch_log_stream_deletion.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

impact_ec2_disable_ebs_encryption.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

impact_ec2_ebs_snapshot_access_removed.toml

[Rule Tuning] ESQL Query Field Dynamic Field Standardization (#4912)

2025-08-05 19:35:41 -04:00

impact_efs_filesystem_or_mount_deleted.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

impact_iam_deactivate_mfa_device.toml

[New Rule] AWS STS AssumeRole with New MFA Device [Rule Tuning] AWS IAM Deactivation of MFA Device (#4210)

2024-11-05 02:09:05 -05:00

impact_iam_group_deletion.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

impact_kms_cmk_disabled_or_scheduled_for_deletion.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

impact_rds_group_deletion.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

impact_rds_instance_cluster_deletion_protection_disabled.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

impact_rds_instance_cluster_deletion.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

impact_rds_instance_cluster_stoppage.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

impact_rds_snapshot_deleted.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

impact_s3_bucket_object_uploaded_with_ransom_extension.toml

[Rule Tuning] ESQL Query Field Dynamic Field Standardization (#4912)

2025-08-05 19:35:41 -04:00

impact_s3_excessive_object_encryption_with_sse_c.toml

[Rule Tunings] Reduce Usage of Flattened Fields in AWS Rules (#4892)

2025-07-18 19:15:36 -04:00

impact_s3_object_encryption_with_external_key.toml

[Rule Tuning] ESQL Query Field Dynamic Field Standardization (#4912)

2025-08-05 19:35:41 -04:00

impact_s3_object_versioning_disabled.toml

Replace master doc URLs with current (#4439)

2025-02-03 21:27:50 +05:30

impact_s3_static_site_js_file_uploaded.toml

[Rule Tuning] ESQL Query Field Dynamic Field Standardization (#4912)

2025-08-05 19:35:41 -04:00

impact_s3_unusual_object_encryption_with_sse_c.toml

[Rule Tunings] Reduce Usage of Flattened Fields in AWS Rules (#4892)

2025-07-18 19:15:36 -04:00

initial_access_console_login_root.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

initial_access_iam_session_token_used_from_multiple_addresses.toml

[Rule Tuning] ESQL Query Field Dynamic Field Standardization (#4912)

2025-08-05 19:35:41 -04:00

initial_access_kali_user_agent_detected_with_aws_cli.toml

[New Rule] Adding Coverage for AWS CLI with Kali Linux Fingerprint Identified (#4625)

2025-04-21 12:06:57 -04:00

initial_access_password_recovery.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

initial_access_signin_console_login_no_mfa.toml

[Rule Tuning] ESQL Query Field Dynamic Field Standardization (#4912)

2025-08-05 19:35:41 -04:00

lateral_movement_aws_ssm_start_session_to_ec2_instance.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

lateral_movement_ec2_instance_connect_ssh_public_key_uploaded.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

lateral_movement_ec2_instance_console_login.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

lateral_movement_sns_topic_message_publish_by_rare_user.toml

[New Rule] Adding Coverage for SNS Topic Message Publish by Rare User (#4350)

2025-01-15 13:55:45 -05:00

ml_cloudtrail_error_message_spike.toml

Adding setup templates to the ML rules (#3798)

2024-06-19 10:04:41 -04:00

ml_cloudtrail_rare_error_code.toml

Adding setup templates to the ML rules (#3798)

2024-06-19 10:04:41 -04:00

ml_cloudtrail_rare_method_by_city.toml

Adding setup templates to the ML rules (#3798)

2024-06-19 10:04:41 -04:00

ml_cloudtrail_rare_method_by_country.toml

Adding setup templates to the ML rules (#3798)

2024-06-19 10:04:41 -04:00

ml_cloudtrail_rare_method_by_user.toml

Adding setup templates to the ML rules (#3798)

2024-06-19 10:04:41 -04:00

NOTICE.txt

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

persistence_aws_attempt_to_register_virtual_mfa_device.toml

[New Rule] Adding Coverage for AWS IAM Virtual MFA Device Registration (#4626)

2025-04-21 11:02:14 -04:00

persistence_ec2_network_acl_creation.toml

[Rule Tunings] AWS EC2 Flow Log Deletion and Network ACL Activity (#4778)

2025-06-06 14:11:54 -04:00

persistence_ec2_route_table_modified_or_deleted.toml

Fix remaining Replace master doc URLs with current (#4441)

2025-02-03 23:03:20 +05:30

persistence_ec2_security_group_configuration_change_detection.toml

[Rule Tunings] Reduce Usage of Flattened Fields in AWS Rules (#4892)

2025-07-18 19:15:36 -04:00

persistence_iam_api_calls_via_user_session_token.toml

[Rule Tuning] AWS IAM API Calls via Temporary Session Tokens (#4901)

2025-07-15 19:13:16 -04:00

persistence_iam_create_login_profile_for_root.toml

[Rule Tuning] ESQL Query Field Dynamic Field Standardization (#4912)

2025-08-05 19:35:41 -04:00

persistence_iam_create_user_via_assumed_role_on_ec2_instance.toml

[Tuning] AWS IAM Create User via Assumed Role on EC2 Instance (#5063)

2025-09-11 15:11:40 -04:00

persistence_iam_group_creation.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_iam_roles_anywhere_profile_created.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_iam_roles_anywhere_trusted_anchor_created_with_external_ca.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_iam_user_created_access_keys_for_another_user.toml

[Rule Tuning] ESQL Query Field Dynamic Field Standardization (#4912)

2025-08-05 19:35:41 -04:00

persistence_lambda_backdoor_invoke_function_for_any_principal.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_rds_cluster_creation.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_rds_db_instance_password_modified.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_rds_group_creation.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_rds_instance_creation.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_rds_instance_made_public.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_redshift_instance_creation.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_route_53_domain_transfer_lock_disabled.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_route_53_domain_transferred_to_another_account.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_route_53_hosted_zone_associated_with_a_vpc.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_route_table_created.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_sts_assume_role_with_new_mfa.toml

[Rule Tuning] AWS STS AssumeRole with New MFA Device (#4999)

2025-08-22 14:48:39 -04:00

privilege_escalation_iam_administratoraccess_policy_attached_to_group.toml

[Rule Tuning] ESQL Query Field Dynamic Field Standardization (#4912)

2025-08-05 19:35:41 -04:00

privilege_escalation_iam_administratoraccess_policy_attached_to_role.toml

[Rule Tuning] ESQL Query Field Dynamic Field Standardization (#4912)

2025-08-05 19:35:41 -04:00

privilege_escalation_iam_administratoraccess_policy_attached_to_user.toml

[Rule Tuning] ESQL Query Field Dynamic Field Standardization (#4912)

2025-08-05 19:35:41 -04:00

privilege_escalation_iam_customer_managed_policy_attached_to_role.toml

Fix updated_date for tunings as part of #5079 (#5081)

2025-09-10 22:05:36 +05:30

privilege_escalation_iam_saml_provider_updated.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

privilege_escalation_iam_update_assume_role_policy.toml

Fix updated_date for tunings as part of #5079 (#5081)

2025-09-10 22:05:36 +05:30

privilege_escalation_role_assumption_by_service.toml

[Rule Tunings] AWS Role Assumption By Service / User (#4827)

2025-06-24 18:07:18 -04:00

privilege_escalation_role_assumption_by_user.toml

[Rule Tunings] AWS Role Assumption By Service / User (#4827)

2025-06-24 18:07:18 -04:00

privilege_escalation_root_login_without_mfa.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

privilege_escalation_sts_assume_root_from_rare_user_and_member_account.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

privilege_escalation_sts_getsessiontoken_abuse.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

privilege_escalation_sts_role_chaining.toml

[Rule Tuning] ESQL Query Field Dynamic Field Standardization (#4912)

2025-08-05 19:35:41 -04:00

resource_development_sns_topic_created_by_rare_user.toml

[New Rule] Adding Coverage for AWS SNS Topic Created by Rare User (#4455)

2025-02-20 10:05:40 -05:00