[New Rule] AWS STS GetSessionToken Abuse

[austinsonger]

Description

Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.

Required Info

Target indexes

filebeat-*, logs-aws*

Platforms

AWS Cloudtrail

Optional Info

Query

event.dataset:aws.cloudtrail and 
event.provider:sts.amazonaws.com and 
event.action:GetSessionToken and aws.cloudtrail.user_identity.type:IAMUser and
event.outcome:success

event.dataset:aws.cloudtrail and event.provider:sts.amazonaws.com and event.action:GetSessionToken and aws.cloudtrail.user_identity.type:IAMUser and event.outcome:success

What is the user type for just a plain IAM user?

New fields required in ECS/data sources for this rule?

Related issues or PRs

• #955

False Positives

MITRE

Tactic	Technique ID	Technique Name	Sub-Technique Name
Privilege Escalation	T1548	Abuse Elevation Control Mechanism
Lateral Movement	T1550	Use Alternate Authentication Material	Application Access Token

lateral_movement_sts_getsessiontoken_abuse.toml

References

Tags

Elastic,Cloud,AWS,Continuous Monitoring, SecOps,Identity and Access

Example Data

[austinsonger]

Added #955 to the issues that related.

[austinsonger]

Working on a branch right now and will create a pull request when completed.

[botelastic]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[brokensound77]

open PR in review