AWS ECS task definitions that reference container credential endpoint URI

title: AWS ECS task definitions that reference container credential endpoint URI
id: ba23f9b8-084f-46c8-a4c8-134561ae1cfa
status: test
description: This rule flags AWS API activity where ECS task definitions are described, registered, or run while the container command includes the $AWS_CONTAINER_CREDENTIALS_RELATIVE_URI value. Querying the container credential endpoint can be used to access task credentials and may indicate credential-harvesting or backdoor-like persistence behavior. The detection relies on CloudTrail events for ECS operations and inspects the containerDefinitions.command field for the credential endpoint reference.
references:
  - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/ecs__backdoor_task_def/main.py
  - https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_RegisterTaskDefinition.html
  - https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_ecs_task_definition_cred_endpoint_query.yml
author: Darin Smith, Huntrule Team
date: 2022-06-07
modified: 2023-04-24
tags:
  - attack.persistence
  - attack.t1525
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: ecs.amazonaws.com
    eventName:
      - DescribeTaskDefinition
      - RegisterTaskDefinition
      - RunTask
    requestParameters.containerDefinitions.command|contains: $AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
  condition: selection
falsepositives:
  - Task Definition being modified to request credentials from the Task Metadata Service for valid reasons
level: medium
license: DRL-1.1
related:
  - id: b94bf91e-c2bf-4047-9c43-c6810f43baad
    type: derived