AWS CloudTrail: Detect assumed-role IMDS activity outside SSM-managed instance registration

title: "AWS CloudTrail: Detect assumed-role IMDS activity outside SSM-managed instance registration"
id: 86777e12-c3bb-4a7b-b654-6871de7a81e1
status: test
description: This rule flags CloudTrail events where an EC2 instance identity (assumed-role ARN) performs actions not associated with SSM-managed instance registration. Attackers who compromise an instance may use stolen or abused instance credentials to pivot to other AWS services while avoiding SSM registration patterns. It relies on CloudTrail telemetry fields including eventSource, eventName, sourceIPAddress, and the assumed-role userIdentity ARN matching the role pattern.
references:
  - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-identity-roles.html
  - https://ermetic.com/blog/aws/aws-ec2-imds-what-you-need-to-know/
  - https://www.packetmischief.ca/2023/07/31/amazon-ec2-credential-exfiltration-how-it-happens-and-how-to-mitigate-it/#lifting-credentials-from-imds-this-is-why-we-cant-have-nice-things
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_imds_malicious_usage.yml
author: jamesc-grafana, Huntrule Team
date: 2024-07-11
tags:
  - attack.privilege-escalation
  - attack.initial-access
  - attack.persistence
  - attack.stealth
  - attack.t1078
  - attack.t1078.002
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    userIdentity.arn|re: .+:assumed-role/aws:.+
  filter_main_generic:
    - eventSource: ssm.amazonaws.com
    - eventName: RegisterManagedInstance
    - sourceIPAddress: AWS Internal
  condition: selection and not 1 of filter_main_*
falsepositives:
  - A team has configured an EC2 instance to use instance profiles that grant the option for the EC2 instance to talk to other AWS Services
level: high
license: DRL-1.1
related:
  - id: 352a918a-34d8-4882-8470-44830c507aa3
    type: derived