huntrule

AWS Glue Development Endpoint Management via CloudTrail API

Flags Glue Create/Update/DeleteDevEndpoint API activity in CloudTrail that may indicate suspicious development endpoint management.

FreeUnreviewedSigmalowv1
title: AWS Glue Development Endpoint Management via CloudTrail API
id: 9146423e-827e-424c-8b28-58692c1ec12b
status: test
description: This rule matches CloudTrail events where AWS Glue development endpoints are created, updated, or deleted. Attackers may use these endpoints to interact with or modify Glue development resources as part of broader abuse, so tracking these management actions helps identify suspicious activity. It relies on CloudTrail telemetry for Glue API calls from the aws glueservice event source and the specific endpoint lifecycle event names.
references:
  - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/
  - https://docs.aws.amazon.com/glue/latest/webapi/API_CreateDevEndpoint.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_passed_role_to_glue_development_endpoint.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-10-03
modified: 2022-12-18
tags:
  - attack.privilege-escalation
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: glue.amazonaws.com
    eventName:
      - CreateDevEndpoint
      - DeleteDevEndpoint
      - UpdateDevEndpoint
  condition: selection
falsepositives:
  - Glue Development Endpoint Activity may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - If known behavior is causing false positives, it can be exempted from the rule.
level: low
license: DRL-1.1
related:
  - id: 4990c2e3-f4b8-45e3-bc3c-30b14ff0ed26
    type: derived

What it detects

This rule matches CloudTrail events where AWS Glue development endpoints are created, updated, or deleted. Attackers may use these endpoints to interact with or modify Glue development resources as part of broader abuse, so tracking these management actions helps identify suspicious activity. It relies on CloudTrail telemetry for Glue API calls from the aws glueservice event source and the specific endpoint lifecycle event names.

Known false positives

  • Glue Development Endpoint Activity may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  • If known behavior is causing false positives, it can be exempted from the rule.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.