Rules Contributing to Suspicious Modification of AWS CloudTrail Logs Alert

The following rules are used to identify suspicious activity within AWS Cloudtrail logs. Any one or more of these will trigger Suspicious Modification of AWS CloudTrail Logs Alert. Details for each rule can be viewed by clicking the More Details link in the description.

Title

Description

AWS CloudTrail Log Updated

Identifies an update to an AWS log trail setting that specifies the delivery of log files.

Rule ID

aws_34

Query

{'selection1': {'eventSource': 'cloudtrail.amazonaws.com'}, 'selection2': {'eventName': 'UpdateTrail'}, 'condition': 'selection1 and selection2'}

Log Source

Stellar Cyber AWS configured.

Rule Source

Developed internally by Stellar Cyber

Tactics, Techniques, and Procedures

TA0009, TA0040, T1530, T1565

References

N/A

Severity

25

Suppression Logic Based On

  • service_id
  • eventSource
  • eventName
  • stellar.rule_id

Additional Information

Maturity Creation Date Risk Level False Positives
production 2020/06/10 low

  • Trail updates may be made by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Trail updates from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Federated user attempting to assume role

A federated user is attempting to assume a role. Federation users enable to manage access to AWS accounts by adding and removing users from the corporate directory, such as Microsoft Active Directory.

Rule ID

aws_110

Query

{'selection1': {'eventSource': 'cloudtrail.amazonaws.com'}, 'selection2': {'errorMessage': 'Roles may not be assumed by federated users'}, 'condition': 'selection1 and selection2'}

Log Source

Stellar Cyber AWS configured.

Rule Source

Developed internally by Stellar Cyber

Tactics, Techniques, and Procedures

TA0004, T1078

References

N/A

Severity

50

Suppression Logic Based On

  • service_id
  • eventSource
  • eventName
  • stellar.rule_id

Additional Information

Maturity Creation Date Risk Level False Positives
test 2022/01/05 medium N/A

AWS Impair Security Services

This analytic looks for several delete specific API calls made to AWS Security Services like CloudWatch, GuardDuty and Web Application Firewalls.

Rule ID

aws_116

Query

{'selection1': {'eventSource': 'cloudtrail.amazonaws.com'}, 'selection2': {'eventName': 'DeleteLogStream'}, 'selection3': {'eventName': 'DeleteDetector'}, 'selection4': {'eventName': 'DeleteIPSet'}, 'selection5': {'eventName': 'DeleteWebACL'}, 'selection6': {'eventName': 'DeleteRule'}, 'selection7': {'eventName': 'DeleteRuleGroup'}, 'selection8': {'eventName': 'DeleteLoggingConfiguration'}, 'selection9': {'eventName': 'DeleteAlarms'}, 'condition': 'selection1 and (selection2 or selection3 or selection4 or selection5 or selection6 or selection7 or selection8 or selection9)'}

Log Source

Stellar Cyber AWS configured.

Rule Source

Developed internally by Stellar Cyber

Tactics, Techniques, and Procedures

TA0005, T1562, T1562.008

References

N/A

Severity

70

Suppression Logic Based On

  • service_id
  • eventSource
  • eventName
  • stellar.rule_id

Additional Information

Maturity Creation Date Risk Level False Positives
production 2022-07-26 medium

  • While this search has no known false positives, it is possible that it is a legitimate admin activity.

AWS Privilege Escalation via Group/Role/User Policy

Identifies the request for privilege escalation by modifying AWS Group/Role/User Policy

Rule ID

aws_200

Query

{'selection1': {'eventSource': 'cloudtrail.amazonaws.com', 'eventName': ['AttachGroupPolicy', 'PutGroupPolicy', 'AttachRolePolicy', 'PutRolePolicy', 'AttachUserPolicy', 'PutUserPolicy']}, 'selection2': {'requestParameters_policyArn': ['arn:aws:iam::aws:policy/AdministratorAccess', 'arn:aws:iam::aws:policy/AmazonSNSFullAccess', 'arn:aws:iam::aws:policy/AmazonEC2FullAccess', 'arn:aws:iam::aws:policy/AmazonS3FullAccess', 'arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess', 'arn:aws:iam::aws:policy/AWSCodeCommitPowerUser', 'arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser', 'arn:aws:iam::aws:policy/PowerUserAccess', 'arn:aws:iam::aws:policy/DatabaseAdministrator', 'arn:aws:iam::aws:policy/NetworkAdministrator', 'arn:aws:iam::aws:policy/SystemAdministrator', 'arn:aws:iam::aws:policy/Billing']}, 'condition': 'selection1 and selection2'}

Log Source

Stellar Cyber AWS configured.

Rule Source

Developed internally by Stellar Cyber

Tactics, Techniques, and Procedures

TA0004, T1548

References

N/A

Severity

50

Suppression Logic Based On

  • service_id
  • eventSource
  • eventName
  • stellar.rule_id

Additional Information

Maturity Creation Date Risk Level False Positives
test 2023/06/22 high

  • Valid changes to policy by authorized user/administrator