detection.wiki

Detection rules › Panther

AWS SSO Access Token Retrieved by Unauthenticated IP

Severity
medium
Time window
2h
Match by
sourceIPAddress
Reference
https://blog.christophetd.fr/phishing-for-aws-credentials-via-aws-sso-device-code-authentication/
Source
github.com/panther-labs/panther-analysis

When using AWS in an enterprise environment, best practices dictate to use a single sign-on service for identity and access management. AWS SSO is a popular solution, integrating with third-party providers such as Okta and allowing to centrally manage roles and permissions in multiple AWS accounts. In this post, we demonstrate that AWS SSO is vulnerable by design to device code authentication phishing – just like any identity provider implementing OpenID Connect device code authentication. This technique was first demonstrated by Dr. Nestori Syynimaa for Azure AD. The feature provides a powerful phishing vector for attackers, rendering ineffective controls such as MFA (including Yubikeys) or IP allow-listing at the IdP level.

Rule body yaml

AnalysisType: correlation_rule
RuleID: "AWS.SSO.Access.Token.Retrieved.by.Unauthenticated.IP"
DisplayName: "AWS SSO Access Token Retrieved by Unauthenticated IP"
Enabled: true
Severity: Medium
Description: |-
    When using AWS in an enterprise environment, best practices dictate to use a single sign-on service for identity and access management. AWS SSO is a popular solution, integrating with third-party providers such as Okta and allowing to centrally manage roles and permissions in multiple AWS accounts.

    In this post, we demonstrate that AWS SSO is vulnerable by design to device code authentication phishing – just like any identity provider implementing OpenID Connect device code authentication. This technique was first demonstrated by Dr. Nestori Syynimaa for Azure AD. The feature provides a powerful phishing vector for attackers, rendering ineffective controls such as MFA (including Yubikeys) or IP allow-listing at the IdP level.
Reference: https://blog.christophetd.fr/phishing-for-aws-credentials-via-aws-sso-device-code-authentication/
Detection:
    - Sequence:
        - ID: Absent CLI Prompt
          RuleID: Sign-in.with.AWS.CLI.prompt
          Absence: true
        - ID: SSO Access Token Retrieved
          RuleID: Retrieve.SSO.access.token
      Transitions:
        - ID: Absent CLI Prompt TO Access Token Retrieved ON IP Addr
          From: Absent CLI Prompt
          To: SSO Access Token Retrieved
          WithinTimeFrameMinutes: 120
          Match:
            - On: sourceIPAddress
      Schedule:
        RateMinutes: 1440
        TimeoutMinutes: 5
      LookbackWindowMinutes: 2160
Tests:
  - Name: AWS SSO Access Token Retrieved by Authenticated IP
    ExpectedResult: false
    RuleOutputs:
    - ID: Absent CLI Prompt
      Matches:
        sourceIPAddress:
          "1.2.3.4":
            - 0
    - ID: SSO Access Token Retrieved
      Matches:
        sourceIPAddress:
          "1.2.3.4":
            - 2
  - Name: AWS SSO Access Token Retrieved by Unauthenticated IP
    ExpectedResult: true
    RuleOutputs:
    - ID: SSO Access Token Retrieved
      Matches:
        sourceIPAddress:
          "1.2.3.4":
            - 2

Detection logic

Stage 1: step Absent CLI Prompt (negated) ordered before $SSO Access Token Retrieved

References detection Sign-in.with.AWS.CLI.prompt.

Stage 2: step SSO Access Token Retrieved ordered after $Absent CLI Prompt

References detection Retrieve.SSO.access.token.