AWS Java_Ghost security group creation attempt

cloudtrail

Classification:

attack

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Goal

Detect when an attempt to create an AWS security group called “Java_Ghost” is observed.

Strategy

Monitor CloudTrail and detect when an attempt to create an AWS security group called “Java_Ghost” has been observed. Datadog’s security research team has assessed with high confidence that an occurrence of this event likely means that identity {{@userIdentity.arn}} has been compromised. An attacker may try to create a security group to maintain access to any EC2 instances created.

Triage and response

  1. Determine other actions taken by the identity {{@userIdentity.arn}} by looking at past activity and the types of API calls occurring.
  2. Begin your company’s incident response process and an investigation.