AWSCloudTrail - Unauthorized EC2 Instance Setup Attempt

id: f7210a45-12a4-4d02-b59e-f23476827a4b
name: AWSCloudTrail - Unauthorized EC2 Instance Setup Attempt
description: |
  Detects an unauthorized attempt to launch an EC2 instance by a user without the necessary permissions. This may indicate an attempt to provision malicious infrastructure within the AWS subscription. Reference: https://stratus-red-team.cloud/attack-techniques/AWS/aws.execution.ec2-launch-unusual-instances/
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: AWS
    dataTypes:
      - AWSCloudTrail
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - ResourceDevelopment
relevantTechniques:
  - T1583
query: |
 AWSCloudTrail
 | where EventName == "RunInstances"
 | where ErrorCode == "Client.UnauthorizedOperation"
 | project TimeGenerated, AwsEventId, EventTypeName, UserIdentityPrincipalid, UserIdentityType,  UserIdentityAccountId, SessionMfaAuthenticated, SessionCreationDate, SessionIssuerUserName, SourceIpAddress, AWSRegion, UserAgent, RequestParameters, ErrorMessage
 | extend UserName = substring(UserIdentityPrincipalid, indexof_regex(UserIdentityPrincipalid, ":") + 1)
 | extend Name = split(UserName,'@')[0],UpnSuffix = split(UserName,'@')[1]
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: Name
      - identifier: UPNSuffix
        columnName: UpnSuffix
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIpAddress
customDetails:
  AWSRegion: AWSRegion
  UserAgent: UserAgent
  ErrorMessage: ErrorMessage
  UserIdentityType: UserIdentityType
alertDetailsOverride:
  alertDisplayNameFormat: Unauthorized EC2 instance launch attempt by {{UserIdentityPrincipalid}} in {{AWSRegion}}
  alertDescriptionFormat: User {{UserIdentityPrincipalid}} (type {{UserIdentityType}}) attempted an unauthorized EC2 instance launch in region {{AWSRegion}}.
version: 1.0.1
kind: Scheduled