« AWS IAM Permission Boundary or Guardrail Policy Deleted by Unusual Identity AWS IAM User Self-Created Access Key Subsequently Used »
Elastic Docs ›Elastic Security [8.19] ›Downloadable rule update v8.19.29

AWS Batch Job Submitted with Container Override by Unusual Identity

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

AWS Batch Job Submitted with Container Override by Unusual Identity

edit

Detects the first time an AWS identity submits an AWS Batch job with a container command override ("containerOverrides.command"), indicating a runtime-modified execution environment. Command overrides allow the submitter to replace the default command of a job definition at submission time. This flexibility is commonly abused by adversaries to inject malicious commands or exfiltration logic into otherwise legitimate Batch compute environments without modifying the underlying job definition — making the malicious activity harder to detect through configuration review alone.

Rule type: new_terms

Rule indices:

  • logs-aws.cloudtrail-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-6m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Cloud
  • Data Source: AWS
  • Data Source: Amazon Web Services
  • Data Source: AWS Batch
  • Use Case: Threat Detection
  • Tactic: Execution
  • Resources: Investigation Guide

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating AWS Batch Job Submitted with Container Override by Unusual Identity

This rule fires when an identity submits a Batch job with a container command override and has not been observed doing so in the prior 7 days. Container overrides at submission time bypass job definition review — an adversary can inject a malicious command into an approved job definition without modifying it, making the change invisible to IaC drift detection or configuration compliance tools.

Possible investigation steps

  • Identify the submitting principal (aws.cloudtrail.user_identity.arn) and determine whether they are expected to use AWS Batch with runtime overrides.
  • Review aws.cloudtrail.request_parameters to extract the overridden command in containerOverrides.command - this is the trigger. Also inspect any environment variables or resource requirements present. Look for shell commands, curl/wget calls, base64-encoded payloads, or references to external endpoints in the command override.
  • Identify the job queue and job definition used to understand the compute environment and IAM role the job will execute under.
  • Search for DescribeJobs events after the submission to track execution status and output.
  • Correlate with S3 GetObject or PutObject events from the Batch execution role during the job’s execution window to identify data access or exfiltration.

False positive analysis

  • ETL and data processing pipelines that parameterize job commands at submission time.
  • CI/CD systems that submit test jobs with dynamic parameters.

Response and remediation

  • If unauthorized, cancel the job immediately using TerminateJob.
  • Review the Batch compute environment’s IAM execution role for the scope of data access the job had.
  • Restrict batch:SubmitJob with Condition keys on batch:Image and job queue ARNs to prevent arbitrary container override submissions.

Setup

edit

The AWS CloudTrail integration must be enabled and configured to collect Batch management events (batch.amazonaws.com).

Rule query

edit
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "batch.amazonaws.com"
    and event.action: "SubmitJob"
    and event.outcome: "success"
    and aws.cloudtrail.request_parameters: (*containerOverrides* and *command*)

Framework: MITRE ATT&CKTM

« AWS IAM Permission Boundary or Guardrail Policy Deleted by Unusual Identity AWS IAM User Self-Created Access Key Subsequently Used »