Indications of malicious key pair creation by long term access key
이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다.Goal
Detect when a key pair is created using a long-term access key that has a suspicious naming convention.
Strategy
This rule lets you monitor CloudTrail logs for CreateKeyPair and AuthorizeSecurityGroupIngress or CreateSecurityGroup events that used a long-term access key.
Datadog’s security research team has observed key pair naming conventions that include a common noun followed by a string of alphanumeric characters. The attack pattern can indicate that the long-term access key used has been compromised, {{@userIdentity.accessKeyId}}.
Triage and response
- Determine if the user,
{{@userIdentity.arn}}, should be generating a new key pair. - Investigate the user behavior and access information:
- Review the user agent, IP address, and other identifying information for evidence of an abnormal access.
- Look at additional events, such as
{{@userIdentity.arn}} and {{@userIdentity.accessKeyId}} attaching a key pair to an EC2 instance during the surrounding timeframe. The related events can be searched for in EC2 logs: @eventSource:ec2.amazonaws.com and @evt.name:ImportKeypair.
- If the behavior is abnormal for the user and your environment:
- Rotate the credentials.
- Investigate if the same credentials took other unauthorized actions.
- Begin your company’s IR process and investigate.
