AWS CloudTrail: Detect AssumeRole events where the caller is an assumed role

Alert on CloudTrail AssumeRole events initiated from an already assumed role session.

FreeUnreviewedSigmalowv1

aws-cloudtrail-detect-assumerole-events-where-the-caller-is-an-assumed-role-905d389b

title: "AWS CloudTrail: Detect AssumeRole events where the caller is an assumed role"
id: 3f41df0b-64e7-4c8f-8201-d492469e372b
status: test
description: This rule flags AWS STS AssumeRole activity captured in CloudTrail when the event comes from an assumed role session. Role-to-role assumption is a common mechanism for lateral movement and privilege escalation, so suspicious or unexpected chains are important to investigate. It relies on CloudTrail fields indicating userIdentity.type is AssumedRole and the session issuer type is Role.
references:
  - https://github.com/elastic/detection-rules/pull/1214
  - https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_sts_assumerole_misuse.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-07-24
modified: 2022-10-09
tags:
  - attack.lateral-movement
  - attack.privilege-escalation
  - attack.t1548
  - attack.t1550
  - attack.t1550.001
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    userIdentity.type: AssumedRole
    userIdentity.sessionContext.sessionIssuer.type: Role
  condition: selection
falsepositives:
  - AssumeRole may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - AssumeRole from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
  - Automated processes that uses Terraform may lead to false positives.
level: low
license: DRL-1.1
related:
  - id: 905d389b-b853-46d0-9d3d-dea0d3a3cd49
    type: derived

What it detects

This rule flags AWS STS AssumeRole activity captured in CloudTrail when the event comes from an assumed role session. Role-to-role assumption is a common mechanism for lateral movement and privilege escalation, so suspicious or unexpected chains are important to investigate. It relies on CloudTrail fields indicating userIdentity.type is AssumedRole and the session issuer type is Role.

Known false positives

AssumeRole may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
AssumeRole from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
Automated processes that uses Terraform may lead to false positives.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.