AWS Threat Hunting Ideas: EC2

Overview:

The following are basic ideas of threat hunting searches that can be done within EC2 instances.

1. Unauthorized Instance Launch (RunInstances)

• Goal: Detect unauthorized EC2 instance creation (e.g., rogue instances).

• CloudTrail Event: RunInstances

• Hunting Idea:

  • Identify EC2 instances launched outside business hours or in unexpected regions.

    bashCopy codeaws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=RunInstances

  • Look for instances launched using unusual instance types (e.g., GPU-enabled instances often used in cryptomining).

2. Security Group Changes (AuthorizeSecurityGroupIngress/RevokeSecurityGroupIngress)

• Goal: Detect attackers opening critical ports (e.g., SSH or RDP) or removing security controls.

• CloudTrail Event: AuthorizeSecurityGroupIngress or RevokeSecurityGroupIngress

• Hunting Idea:

  • Identify unauthorized changes that open ports like 22 (SSH) or 3389 (RDP).

    aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=AuthorizeSecurityGroupIngress

  • Correlate with other suspicious activity (e.g., an unauthorized user changing security groups and logging in via SSH).

3. Stopping or Terminating EC2 Instances (StopInstances/TerminateInstances)

• Goal: Detect instances being shut down or destroyed maliciously.

• CloudTrail Event: StopInstances, TerminateInstances

• Hunting Idea:

  • Monitor for StopInstances or TerminateInstances requests, especially during unusual times or from unexpected users.

    aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=TerminateInstances

  • Review the user identity and source IP to ensure authorized personnel issued the commands.

4. Modifying IAM Role Attached to EC2 (AssociateIamInstanceProfile)

• Goal: Detect privilege escalation via IAM role changes on EC2 instances.

• CloudTrail Event: AssociateIamInstanceProfile or ReplaceIamInstanceProfileAssociation

• Hunting Idea:

  • Hunt for new IAM roles associated with EC2 instances that grant broader privileges than the previous roles.

    aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=AssociateIamInstanceProfile

  • Identify if critical roles like AdministratorAccess or other privileged policies were attached to instances.

5. Metadata Exploitation Detection (GetInstanceMetadata/DescribeInstances)

• Goal: Detect attempts to abuse metadata services (e.g., to steal IAM credentials).

• CloudTrail Event: DescribeInstances

• Hunting Idea:

  • Look for frequent DescribeInstances calls, which may indicate enumeration by an attacker.

    aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=DescribeInstances

  • Identify instances making outbound requests to metadata IP (169.254.169.254) to fetch credentials.

6. Disabling Security Monitoring (DisableAlarmActions)

• Goal: Detect attackers disabling CloudWatch alarms to avoid detection.

• CloudTrail Event: DisableAlarmActions

• Hunting Idea:

  • Monitor for DisableAlarmActions events targeting alarms related to EC2 monitoring.

    aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=DisableAlarmActions

  • Correlate with other suspicious activity, such as privilege escalation or large outbound network transfers.

7. Snapshot Creation and Copying (CreateSnapshot/CopySnapshot)

• Goal: Detect potential data theft by creating snapshots of sensitive volumes.

• CloudTrail Event: CreateSnapshot, CopySnapshot

• Hunting Idea:

  • Hunt for CreateSnapshot events targeting volumes attached to critical instances.

    aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=CreateSnapshot

  • Check if snapshots are copied to external or unauthorized AWS accounts using CopySnapshot.

8. Changes to Key Pairs (ImportKeyPair/DeleteKeyPair)

• Goal: Detect unauthorized modifications to SSH keys used to access EC2 instances.

• CloudTrail Event: ImportKeyPair, DeleteKeyPair

• Hunting Idea:

  • Monitor for ImportKeyPair events to identify unauthorized SSH key uploads.

    aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=ImportKeyPair

  • Look for deletions (DeleteKeyPair) that could indicate an attacker trying to block legitimate access.

9. Root or Privileged API Calls (AssumeRole/AssumeRoleWithSAML)

• Goal: Detect suspicious role assumptions tied to EC2 instances.

• CloudTrail Event: AssumeRole, AssumeRoleWithSAML

• Hunting Idea:

  • Hunt for AssumeRole events involving roles with administrative or privileged access.

    aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=AssumeRole

  • Cross-reference with EC2 operations to determine if the role was used for malicious activity.

10. Unusual API Usage (DescribeSecurityGroups/DescribeInstances)

• Goal: Detect enumeration or reconnaissance activities by attackers.

• CloudTrail Event: DescribeSecurityGroups, DescribeInstances

• Hunting Idea:

  • Identify unusually frequent or automated calls to DescribeInstances or DescribeSecurityGroups APIs.

    aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=DescribeSecurityGroups

  • Monitor whether the API calls originate from unfamiliar IP addresses or unusual user agents.