New Amazon EC2 Instance type

cloudtrail

Classification:

attack

Tactic:

TA0002-execution

Technique:

T1204-user-execution

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Goal

Detect when an attacker spawns an instance for malicious purposes.

Strategy

This rule lets you monitor this CloudTrail API call to detect when a new instance type (@responseElements.instancesSet.items.instanceType) is spawned:

It does this by inspecting the AWS Instance types each AWS account are seen over a 7-day window. Newly detected instance types after this 7-day window till generate security signals.

Triage and response

  1. Determine whether the instance type {{@responseElements.instancesSet.items.instanceType}} is expected to be used in your AWS account by checking the Datadog Infrastructure List.
  2. If not, determine who spawned this instance and ask the user whether their activity was legitimate or whether their credentials were compromised and this instance is being used by an attacker.

Changelog

7 April 2022 - Updated rule query.