AWS ECS Task Definition That Queries The Credential Endpoint

Status: test
Severity: medium
Log source: product aws, service cloudtrail
Author: Darin Smith
Source: github.com/SigmaHQ/sigma

Detects when an Elastic Container Service (ECS) Task Definition includes a command to query the credential endpoint. This can indicate a potential adversary adding a backdoor to establish persistence or escalate privileges.

Known false positives

Task Definition being modified to request credentials from the Task Metadata Service for valid reasons

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1525` Implant Internal Image

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `DescribeTaskDefinition`: Describes a task definition registered to Amazon ECS, returning its family, revision, container definitions, and configuration.
AWS	CloudTrail event `RegisterTaskDefinition`: Registers a new task definition from the supplied family and containerDefinitions, creating a new revision in Amazon ECS.
AWS	CloudTrail event `RunTask`: Starts a new task on a specified cluster using the specified task definition.

Rules detecting the same action

These rules filter on the same operation.

AWS Potential Cryptomining via ECS Task Definition Deployment (Elastic)

Rule body

title: AWS ECS Task Definition That Queries The Credential Endpoint
id: b94bf91e-c2bf-4047-9c43-c6810f43baad
status: test
description: |
    Detects when an Elastic Container Service (ECS) Task Definition includes a command to query the credential endpoint.
    This can indicate a potential adversary adding a backdoor to establish persistence or escalate privileges.
references:
    - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/ecs__backdoor_task_def/main.py
    - https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_RegisterTaskDefinition.html
    - https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html
author: Darin Smith
date: 2022-06-07
modified: 2023-04-24
tags:
    - attack.persistence
    - attack.t1525
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'ecs.amazonaws.com'
        eventName:
            - 'DescribeTaskDefinition'
            - 'RegisterTaskDefinition'
            - 'RunTask'
        requestParameters.containerDefinitions.command|contains: '$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI'
    condition: selection
falsepositives:
    - Task Definition being modified to request credentials from the Task Metadata Service for valid reasons
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    eventSource: 'ecs.amazonaws.com'
    eventName:
        - 'DescribeTaskDefinition'
        - 'RegisterTaskDefinition'
        - 'RunTask'
    requestParameters.containerDefinitions.command|contains: '$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`DescribeTaskDefinition` `RegisterTaskDefinition` `RunTask`	`field:"aws::eventName" kind:eq`
`eventSource`	eq	`ecs.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"ecs.amazonaws.com"`
`requestParameters.containerDefinitions.command`	match	`$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI`	`field:"requestParameters.containerDefinitions.command" kind:match value:"$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"`