AWS ECS Task Definition Commands Query AWS Container Credentials Endpoint
Alerts on ECS Describe/Register/Run activity when task container commands reference the container credential endpoint URI.
- Product
- aws
- Service
- cloudtrail
- Author
- Darin Smith (SigmaHQ), DRL 1.1
- Published
- 2022-06-07
- Updated
- 2026-07-31
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies ECS activity where a task definition (or a related run) includes a container command that contains the $AWS_CONTAINER_CREDENTIALS_RELATIVE_URI string, indicating an attempt to query the container credentials endpoint. Such behavior can be used by an attacker to obtain credentials for follow-on access, persistence, or privilege escalation. It relies on AWS CloudTrail events for ECS actions including DescribeTaskDefinition, RegisterTaskDefinition, and RunTask, with matching content in the containerDefinitions.command request parameters.
Reporting behind it
- github.comhttps://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/ecs__backdoor_task_def/main.py
- docs.aws.amazon.comhttps://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_RegisterTaskDefinition.html
- docs.aws.amazon.comhttps://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_ecs_task_definition_cred_endpoint_query.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: AWS ECS Task Definition Commands Query AWS Container Credentials Endpoint
id: ba23f9b8-084f-46c8-a4c8-134561ae1cfa
status: test
description: This rule identifies ECS activity where a task definition (or a related run) includes a container command that contains the $AWS_CONTAINER_CREDENTIALS_RELATIVE_URI string, indicating an attempt to query the container credentials endpoint. Such behavior can be used by an attacker to obtain credentials for follow-on access, persistence, or privilege escalation. It relies on AWS CloudTrail events for ECS actions including DescribeTaskDefinition, RegisterTaskDefinition, and RunTask, with matching content in the containerDefinitions.command request parameters.
references:
- https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/ecs__backdoor_task_def/main.py
- https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_RegisterTaskDefinition.html
- https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_ecs_task_definition_cred_endpoint_query.yml
author: Darin Smith, Huntrule Team
date: 2022-06-07
modified: 2023-04-24
tags:
- attack.persistence
- attack.t1525
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: ecs.amazonaws.com
eventName:
- DescribeTaskDefinition
- RegisterTaskDefinition
- RunTask
requestParameters.containerDefinitions.command|contains: $AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
condition: selection
falsepositives:
- Task Definition being modified to request credentials from the Task Metadata Service for valid reasons
level: medium
license: DRL-1.1
related:
- id: b94bf91e-c2bf-4047-9c43-c6810f43baad
type: derived