AWS CLI Configuration Modified by Unusual Process

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

AWS CLI Configuration Modified by Unusual Process

Identifies modification of the AWS CLI configuration or alias files by a process that is not a known credential helper, editor, or provisioning tool. The AWS config file supports a credential_process directive that names an arbitrary local executable to source credentials from; an adversary who writes this directive redirects every subsequent AWS CLI and SDK call through a binary of their choosing, harvesting or substituting credentials without touching the credentials file itself. The CLI alias file offers a similar hijack primitive. This write-side abuse leaves no CloudTrail evidence and is substantially quieter than reading the credentials file. Only the AWS CLI, credential-helper tools that rewrite this file as part of normal operation, and a few system agent paths are excluded. Editors, IDEs, dotfile managers, configuration management, shells, and copy utilities are intentionally kept in scope: this is a building block, and a human or script writing a credential_process directive is the context higher-order rules need.

Rule type: query

Rule indices:

logs-endpoint.events.file*

Severity: low

Risk score: 21

Runs every: 60m

Searches indices from: now-119m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: Endpoint
Domain: Cloud
Platform: AWS
Platform: Linux
Platform: macOS
Platform: Windows
OS: Linux
OS: macOS
OS: Windows
Service: AWS IAM
Tactic: Persistence
Tactic: Credential Access
Data Source: Elastic Defend
Rule Type: BBR

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Setup

edit

Setup

This rule requires data coming in from Elastic Defend.

Elastic Defend Integration Setup

Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

Prerequisite Requirements:

Fleet is required for Elastic Defend.
To configure Fleet Server refer to the documentation.

The following steps should be executed in order to add the Elastic Defend integration:

Go to the Kibana home page and click "Add integrations".
In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
Click "Add Elastic Defend".
Configure the integration name and optionally add a description.
Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
Click "Save and Continue".
To complete the integration, select "Add Elastic Agent to your hosts" and install Elastic Agent on your hosts. For more details on Elastic Defend refer to the helper guide.

Rule query

edit

event.category : "file" and event.action : (creation or modification or overwrite or rename) and
file.path : (
  /root/.aws/cli/alias or /root/.aws/config or
  /var/root/.aws/cli/alias or /var/root/.aws/config or
  /private/var/root/.aws/cli/alias or /private/var/root/.aws/config or
  *\\.aws\\cli\\alias or *\\.aws\\config or
  /Users/*/.aws/cli/alias or /Users/*/.aws/config or
  /home/*/.aws/cli/alias or /home/*/.aws/config
) and
process.executable : (* and not (/opt/Elastic/Agent/* or /opt/aws/* or /usr/lib/systemd/*)) and
not process.name : (
  assume or assumego or aws or aws-azure-login or aws-google-auth or aws-mfa or aws-sso or aws-sso-util or
  aws-vault or "aws-vault.exe" or aws.exe or aws_completer or aws_signing_helper or "gimme-aws-creds" or granted or
  leapp or "okta-aws-cli" or saml2aws or saml2aws.exe
)

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Persistence
- ID: TA0003
- Reference URL: https://attack.mitre.org/tactics/TA0003/
Technique:
- Name: Modify Authentication Process
- ID: T1556
- Reference URL: https://attack.mitre.org/techniques/T1556/
Tactic:
- Name: Credential Access
- ID: TA0006
- Reference URL: https://attack.mitre.org/tactics/TA0006/
Technique:
- Name: Modify Authentication Process
- ID: T1556
- Reference URL: https://attack.mitre.org/techniques/T1556/

« AWS CLI Command with Custom Endpoint URL AWS CloudShell Environment Created »