Skip to content

[New] Diverse AWS rules#5913

Merged
Samirbous merged 55 commits into
mainfrom
aws_sbo_rules
May 1, 2026
Merged

[New] Diverse AWS rules#5913
Samirbous merged 55 commits into
mainfrom
aws_sbo_rules

Conversation

@Samirbous

@Samirbous Samirbous commented Apr 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

New:

  • AWS EC2 Role GetCallerIdentity from New Source AS Organization (aws)
  • AWS Discovery API Calls from VPN ASN for the First Time by Identity (aws)
  • AWS SSM Session Manager Child Process Execution (uses endpoint process events)
  • AWS IAM Sensitive Operations via Lambda Execution Role (aws)
  • AWS EC2 Stop, Start, and User Data Modification Correlation (aws)
  • AWS EC2 CreateKeyPair by New Principal from Non-Cloud AS Organization (aws)
  • AWS STS GetFederationToken with AdministratorAccess in Request (aws, we do have a FTS GetFederationToken rule, this one is hitting on suspicious inline policy parameters with higher alert severity)

Samirbous added 3 commits April 3, 2026 10:36
@Samirbous
[New] Diverse AWS Rules
0468056 
- AWS EC2 Role GetCallerIdentity from New Source AS Organization
- AWS CloudTrail API Request with TruffleHog User Agent
@Samirbous
Create discovery_new_terms_vpn_asn_discovery_api_calls.toml
734ba18
@Samirbous
++
fbb69af
@Samirbous Samirbous self-assigned this Apr 3, 2026
@botelastic botelastic Bot added Domain: Cloud Integration: AWS AWS related rules labels Apr 3, 2026
@Samirbous Samirbous added Rule: New Proposal for new rule and removed backport: auto labels Apr 3, 2026
@Samirbous Samirbous added Rule: Tuning tweaking or tuning an existing rule and removed backport: auto labels Apr 3, 2026
@github-actions

github-actions Bot commented Apr 3, 2026

Copy link
Copy Markdown
Contributor

Rule: New - Guidelines

These guidelines serve as a reminder set of considerations when proposing a new rule.

Documentation and Context

  • Detailed description of the rule.
  • List any new fields required in ECS/data sources.
  • Link related issues or PRs.
  • Include references.

Rule Metadata Checks

  • creation_date matches the date of creation PR initially merged.
  • min_stack_version should support the widest stack versions.
  • name and description should be descriptive and not include typos.
  • query should be inclusive, not overly exclusive, considering performance for diverse environments. Non ecs fields should be added to non-ecs-schema.json if not available in an integration.
  • min_stack_comments and min_stack_version should be included if the rule is only compatible starting from a specific stack version.
  • index pattern should be neither too specific nor too vague, ensuring it accurately matches the relevant data stream (e.g., use logs-endpoint.process-* for process data).
  • integration should align with the index. If the integration is newly introduced, ensure the manifest, schemas, and new_rule.yaml template are updated.
  • setup should include the necessary steps to configure the integration.
  • note should include any additional information (e.g. Triage and analysis investigation guides, timeline templates).
  • tags should be relevant to the threat and align/added to the EXPECTED_RULE_TAGS in the definitions.py file.
  • threat, techniques, and subtechniques should map to ATT&CK always if possible.

New BBR Rules

  • building_block_type should be included if the rule is a building block and the rule should be located in the rules_building_block folder.
  • bypass_bbr_timing should be included if adding custom lookback timing to the rule.

Testing and Validation

  • Provide evidence of testing and detecting the expected threat.
  • Check for existence of coverage to prevent duplication.

@Samirbous Samirbous changed the title [New/Tuning] Divers AWS rules [New/Tuning] Diverse AWS rules Apr 3, 2026
@imays11

imays11 commented Apr 3, 2026

Copy link
Copy Markdown
Contributor

@Samirbous @terrancedejesus Should consider adding the additional Kali agents here:

terrancedejesus
terrancedejesus reviewed Apr 3, 2026
View reviewed changes
Comment thread rules/integrations/aws/discovery_new_terms_vpn_asn_discovery_api_calls.toml Outdated
terrancedejesus
terrancedejesus reviewed Apr 3, 2026
View reviewed changes
Comment thread rules/integrations/aws/initial_access_aws_cloudtrail_trufflehog_user_agent.toml Outdated
terrancedejesus
terrancedejesus reviewed Apr 3, 2026
View reviewed changes
Comment thread rules/integrations/aws/initial_access_kali_user_agent_detected_with_aws_cli.toml Outdated
terrancedejesus
terrancedejesus reviewed Apr 3, 2026
View reviewed changes
Comment thread rules/integrations/aws/discovery_new_terms_vpn_asn_discovery_api_calls.toml Outdated
terrancedejesus
terrancedejesus reviewed Apr 3, 2026
View reviewed changes
Comment thread rules/integrations/aws/discovery_new_terms_vpn_asn_discovery_api_calls.toml Outdated
@terrancedejesus

terrancedejesus commented Apr 3, 2026

Copy link
Copy Markdown
Contributor

I'd sync with @imays11 on these. I assume its to address the supply chain attacks lately.
She has an organized meta https://github.com/elastic/ia-trade-team/issues/860 I didn't see referenced.

@terrancedejesus

terrancedejesus commented Apr 3, 2026

Copy link
Copy Markdown
Contributor

Adjusted those changes to: https://github.com/elastic/detection-rules/pull/5902/changes

@tradebot-elastic

tradebot-elastic commented May 1, 2026 •
edited
Loading

Copy link
Copy Markdown

⛔️ Test failed

Results
  • ❌ AWS EC2 Stop, Start, and User Data Modification Correlation (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS IAM Sensitive Operations via Lambda Execution Role (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS EC2 Role GetCallerIdentity from New Source AS Organization (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS EC2 CreateKeyPair by New Principal from Non-Cloud AS Organization (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS SSM Session Manager Child Process Execution (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS IAM Customer Managed Policy Version Created or Default Version Set (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS Discovery API Calls from VPN ASN for the First Time by Identity (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS EC2 Instance Profile Associated with Running Instance (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS STS GetFederationToken with AdministratorAccess in Request (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS KMS Key Policy Updated via PutKeyPolicy (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

terrancedejesus
terrancedejesus reviewed May 1, 2026
View reviewed changes
Comment thread rules/integrations/aws/execution_ec2_stop_start_with_user_data_modification.toml Outdated
@Samirbous @terrancedejesus
Update rules/integrations/aws/privilege_escalation_iam_customer_manag…
ead7edd 
…ed_policy_version_created_or_set_default.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
@tradebot-elastic

tradebot-elastic commented May 1, 2026 •
edited
Loading

Copy link
Copy Markdown

⛔️ Test failed

Results
  • ❌ AWS EC2 Stop, Start, and User Data Modification Correlation (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS IAM Sensitive Operations via Lambda Execution Role (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS EC2 Role GetCallerIdentity from New Source AS Organization (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS EC2 CreateKeyPair by New Principal from Non-Cloud AS Organization (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS SSM Session Manager Child Process Execution (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS IAM Customer Managed Policy Version Created or Default Version Set (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS Discovery API Calls from VPN ASN for the First Time by Identity (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS EC2 Instance Profile Associated with Running Instance (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS STS GetFederationToken with AdministratorAccess in Request (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS KMS Key Policy Updated via PutKeyPolicy (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@Samirbous @terrancedejesus
Update rules/integrations/aws/execution_ec2_stop_start_with_user_data…
1d2cf38 
…_modification.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
@tradebot-elastic

tradebot-elastic commented May 1, 2026 •
edited
Loading

Copy link
Copy Markdown

⛔️ Test failed

Results
  • ❌ AWS EC2 Stop, Start, and User Data Modification Correlation (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS IAM Sensitive Operations via Lambda Execution Role (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS EC2 Role GetCallerIdentity from New Source AS Organization (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS EC2 CreateKeyPair by New Principal from Non-Cloud AS Organization (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS SSM Session Manager Child Process Execution (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS IAM Customer Managed Policy Version Created or Default Version Set (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS Discovery API Calls from VPN ASN for the First Time by Identity (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS EC2 Instance Profile Associated with Running Instance (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS STS GetFederationToken with AdministratorAccess in Request (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS KMS Key Policy Updated via PutKeyPolicy (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic

tradebot-elastic commented May 1, 2026 •
edited
Loading

Copy link
Copy Markdown

⛔️ Test failed

Results
  • ❌ AWS EC2 Stop, Start, and User Data Modification Correlation (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS IAM Sensitive Operations via Lambda Execution Role (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS EC2 Role GetCallerIdentity from New Source AS Organization (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS EC2 CreateKeyPair by New Principal from Non-Cloud AS Organization (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS SSM Session Manager Child Process Execution (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS IAM Customer Managed Policy Version Created or Default Version Set (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS Discovery API Calls from VPN ASN for the First Time by Identity (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS EC2 Instance Profile Associated with Running Instance (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS STS GetFederationToken with AdministratorAccess in Request (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS KMS Key Policy Updated via PutKeyPolicy (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

imays11
imays11 reviewed May 1, 2026
View reviewed changes
Comment thread rules/integrations/aws/execution_ec2_stop_start_with_user_data_modification.toml Outdated
@imays11 imays11 self-requested a review May 1, 2026 18:27
@Samirbous @imays11
Apply suggestion from @imays11
d8fa5b8 
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
@tradebot-elastic

tradebot-elastic commented May 1, 2026 •
edited
Loading

Copy link
Copy Markdown

⛔️ Test failed

Results
  • ❌ AWS EC2 Stop, Start, and User Data Modification Correlation (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS IAM Sensitive Operations via Lambda Execution Role (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS EC2 Role GetCallerIdentity from New Source AS Organization (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS EC2 CreateKeyPair by New Principal from Non-Cloud AS Organization (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS SSM Session Manager Child Process Execution (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS IAM Customer Managed Policy Version Created or Default Version Set (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS Discovery API Calls from VPN ASN for the First Time by Identity (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS EC2 Instance Profile Associated with Running Instance (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS STS GetFederationToken with AdministratorAccess in Request (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS KMS Key Policy Updated via PutKeyPolicy (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic

tradebot-elastic commented May 1, 2026 •
edited
Loading

Copy link
Copy Markdown

⛔️ Test failed

Results
  • ❌ AWS EC2 Stop, Start, and User Data Modification Correlation (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS IAM Sensitive Operations via Lambda Execution Role (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS EC2 Role GetCallerIdentity from New Source AS Organization (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS EC2 CreateKeyPair by New Principal from Non-Cloud AS Organization (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS SSM Session Manager Child Process Execution (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS IAM Customer Managed Policy Version Created or Default Version Set (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS Discovery API Calls from VPN ASN for the First Time by Identity (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS EC2 Instance Profile Associated with Running Instance (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS STS GetFederationToken with AdministratorAccess in Request (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS KMS Key Policy Updated via PutKeyPolicy (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic

tradebot-elastic commented May 1, 2026 •
edited
Loading

Copy link
Copy Markdown

⛔️ Test failed

Results
  • ❌ AWS EC2 Stop, Start, and User Data Modification Correlation (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS IAM Sensitive Operations via Lambda Execution Role (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS EC2 Role GetCallerIdentity from New Source AS Organization (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS EC2 CreateKeyPair by New Principal from Non-Cloud AS Organization (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS SSM Session Manager Child Process Execution (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS IAM Customer Managed Policy Version Created or Default Version Set (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS Discovery API Calls from VPN ASN for the First Time by Identity (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS EC2 Instance Profile Associated with Running Instance (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS STS GetFederationToken with AdministratorAccess in Request (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS KMS Key Policy Updated via PutKeyPolicy (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic

tradebot-elastic commented May 1, 2026 •
edited
Loading

Copy link
Copy Markdown

⛔️ Test failed

Results
  • ❌ AWS EC2 Stop, Start, and User Data Modification Correlation (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS IAM Sensitive Operations via Lambda Execution Role (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS EC2 Role GetCallerIdentity from New Source AS Organization (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS EC2 CreateKeyPair by New Principal from Non-Cloud AS Organization (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS SSM Session Manager Child Process Execution (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS IAM Customer Managed Policy Version Created or Default Version Set (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS Discovery API Calls from VPN ASN for the First Time by Identity (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS EC2 Instance Profile Associated with Running Instance (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS STS GetFederationToken with AdministratorAccess in Request (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS KMS Key Policy Updated via PutKeyPolicy (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@Samirbous Samirbous merged commit 250ad4a into main May 1, 2026
13 checks passed
@Samirbous Samirbous deleted the aws_sbo_rules branch May 1, 2026 20:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@imays11 imays11 imays11 approved these changes
@terrancedejesus terrancedejesus terrancedejesus approved these changes
@eric-forte-elastic eric-forte-elastic Awaiting requested review from eric-forte-elastic
@shashank-elastic shashank-elastic Awaiting requested review from shashank-elastic

Assignees

@Samirbous Samirbous

Labels

backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule Rule: Tuning tweaking or tuning an existing rule

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@Samirbous @imays11 @terrancedejesus @tradebot-elastic @Mikaayenson