New Amazon EC2 Instance type

cloudtrail

Classification:

attack

Tactic:

TA0002-execution

Technique:

T1204-user-execution

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Goal

Detect when an attacker spawns an instance for malicious purposes.

Strategy

This rule lets you monitor this CloudTrail API call to detect when a new instance type (@responseElements.instancesSet.items.instanceType) is spawned:

It does this by inspecting the AWS Instance types each AWS account are seen over a 7-day window. Newly detected instance types after this 7-day window till generate security signals.

Triage and response

  1. Determine whether the instance type {{@responseElements.instancesSet.items.instanceType}} is expected to be used in your AWS account by checking the Datadog Infrastructure List.
  2. If not, determine who spawned this instance and ask the user whether their activity was legitimate or whether their credentials were compromised and this instance is being used by an attacker.

Changelog

7 April 2022 - Updated rule query.