AWS CloudTrail: Suspicious STS AssumeRole sessions from Role-issued principals

title: "AWS CloudTrail: Suspicious STS AssumeRole sessions from Role-issued principals"
id: 3f41df0b-64e7-4c8f-8201-d492469e372b
status: test
description: This rule flags CloudTrail events where the caller’s identity is an assumed role session and the session issuer is of type Role. Such activity can indicate attackers using AWS STS AssumeRole to obtain new credentials, enabling lateral movement and privilege changes within the AWS environment. The detection relies on CloudTrail userIdentity and sessionContext fields that describe the assumed role and its role issuer.
references:
  - https://github.com/elastic/detection-rules/pull/1214
  - https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_sts_assumerole_misuse.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-07-24
modified: 2022-10-09
tags:
  - attack.lateral-movement
  - attack.privilege-escalation
  - attack.t1548
  - attack.t1550
  - attack.t1550.001
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    userIdentity.type: AssumedRole
    userIdentity.sessionContext.sessionIssuer.type: Role
  condition: selection
falsepositives:
  - AssumeRole may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - AssumeRole from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
  - Automated processes that uses Terraform may lead to false positives.
level: low
license: DRL-1.1
related:
  - id: 905d389b-b853-46d0-9d3d-dea0d3a3cd49
    type: derived