Skip to content

[New] Diverse AWS rules#5913

Open
Samirbous wants to merge 24 commits intomainfrom
aws_sbo_rules
Open

[New] Diverse AWS rules#5913
Samirbous wants to merge 24 commits intomainfrom
aws_sbo_rules

Conversation

@Samirbous
Copy link
Copy Markdown
Contributor

@Samirbous Samirbous commented Apr 3, 2026 •
edited
Loading

New:

  • AWS EC2 Role GetCallerIdentity from New Source AS Organization (aws)
  • AWS Discovery API Calls from VPN ASN for the First Time by Identity (aws)
  • AWS SSM Session Manager Child Process Execution (uses endpoint process events)
  • AWS IAM Sensitive Operations via Lambda Execution Role (aws)
  • AWS EC2 Stop, Start, and User Data Modification Correlation (aws)

Samirbous added 3 commits April 3, 2026 10:36
@Samirbous
[New] Diverse AWS Rules
0468056 
- AWS EC2 Role GetCallerIdentity from New Source AS Organization
- AWS CloudTrail API Request with TruffleHog User Agent
@Samirbous
Create discovery_new_terms_vpn_asn_discovery_api_calls.toml
734ba18
@Samirbous
++
fbb69af
@Samirbous Samirbous self-assigned this Apr 3, 2026
@botelastic botelastic bot added Domain: Cloud Integration: AWS AWS related rules labels Apr 3, 2026
@Samirbous Samirbous added Rule: New Proposal for new rule and removed backport: auto labels Apr 3, 2026
@Samirbous Samirbous added Rule: Tuning tweaking or tuning an existing rule and removed backport: auto labels Apr 3, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 3, 2026

Rule: New - Guidelines

These guidelines serve as a reminder set of considerations when proposing a new rule.

Documentation and Context

  • Detailed description of the rule.
  • List any new fields required in ECS/data sources.
  • Link related issues or PRs.
  • Include references.

Rule Metadata Checks

  • creation_date matches the date of creation PR initially merged.
  • min_stack_version should support the widest stack versions.
  • name and description should be descriptive and not include typos.
  • query should be inclusive, not overly exclusive, considering performance for diverse environments. Non ecs fields should be added to non-ecs-schema.json if not available in an integration.
  • min_stack_comments and min_stack_version should be included if the rule is only compatible starting from a specific stack version.
  • index pattern should be neither too specific nor too vague, ensuring it accurately matches the relevant data stream (e.g., use logs-endpoint.process-* for process data).
  • integration should align with the index. If the integration is newly introduced, ensure the manifest, schemas, and new_rule.yaml template are updated.
  • setup should include the necessary steps to configure the integration.
  • note should include any additional information (e.g. Triage and analysis investigation guides, timeline templates).
  • tags should be relevant to the threat and align/added to the EXPECTED_RULE_TAGS in the definitions.py file.
  • threat, techniques, and subtechniques should map to ATT&CK always if possible.

New BBR Rules

  • building_block_type should be included if the rule is a building block and the rule should be located in the rules_building_block folder.
  • bypass_bbr_timing should be included if adding custom lookback timing to the rule.

Testing and Validation

  • Provide evidence of testing and detecting the expected threat.
  • Check for existence of coverage to prevent duplication.

@Samirbous Samirbous changed the title [New/Tuning] Divers AWS rules [New/Tuning] Diverse AWS rules Apr 3, 2026
@imays11
Copy link
Copy Markdown
Contributor

imays11 commented Apr 3, 2026

@Samirbous @terrancedejesus Should consider adding the additional Kali agents here:

@terrancedejesus
Copy link
Copy Markdown
Contributor

terrancedejesus commented Apr 3, 2026

I'd sync with @imays11 on these. I assume its to address the supply chain attacks lately.
She has an organized meta https://github.com/elastic/ia-trade-team/issues/860 I didn't see referenced.

@terrancedejesus
Copy link
Copy Markdown
Contributor

terrancedejesus commented Apr 3, 2026

Adjusted those changes to: https://github.com/elastic/detection-rules/pull/5902/changes

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Apr 3, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ AWS EC2 Role GetCallerIdentity from New Source AS Organization (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS SSM Session Manager Child Process Execution (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS Discovery API Calls from VPN ASN for the First Time by Identity (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Apr 3, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ AWS EC2 Role GetCallerIdentity from New Source AS Organization (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS SSM Session Manager Child Process Execution (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS Discovery API Calls from VPN ASN for the First Time by Identity (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Apr 3, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ AWS EC2 Role GetCallerIdentity from New Source AS Organization (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS SSM Session Manager Child Process Execution (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS Discovery API Calls from VPN ASN for the First Time by Identity (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Apr 4, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ AWS IAM Sensitive Operations via Lambda Execution Role (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS EC2 Role GetCallerIdentity from New Source AS Organization (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS SSM Session Manager Child Process Execution (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS Discovery API Calls from VPN ASN for the First Time by Identity (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Apr 4, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ AWS IAM Sensitive Operations via Lambda Execution Role (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS EC2 Role GetCallerIdentity from New Source AS Organization (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS SSM Session Manager Child Process Execution (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS Discovery API Calls from VPN ASN for the First Time by Identity (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Apr 4, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ AWS EC2 Stop, Start, and User Data Modification Correlation (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS IAM Sensitive Operations via Lambda Execution Role (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS EC2 Role GetCallerIdentity from New Source AS Organization (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS SSM Session Manager Child Process Execution (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS Discovery API Calls from VPN ASN for the First Time by Identity (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Apr 4, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ AWS EC2 Stop, Start, and User Data Modification Correlation (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS IAM Sensitive Operations via Lambda Execution Role (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS EC2 Role GetCallerIdentity from New Source AS Organization (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS SSM Session Manager Child Process Execution (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS Discovery API Calls from VPN ASN for the First Time by Identity (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Apr 4, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ AWS EC2 Stop, Start, and User Data Modification Correlation (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS IAM Sensitive Operations via Lambda Execution Role (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS EC2 Role GetCallerIdentity from New Source AS Organization (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS SSM Session Manager Child Process Execution (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ AWS Discovery API Calls from VPN ASN for the First Time by Identity (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@Samirbous Samirbous changed the title [New/Tuning] Diverse AWS rules [New] Diverse AWS rules Apr 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@imays11 imays11 imays11 left review comments

@terrancedejesus terrancedejesus terrancedejesus left review comments

At least 2 approving reviews are required to merge this pull request.

Assignees

@Samirbous Samirbous

Labels

backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule Rule: Tuning tweaking or tuning an existing rule

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@Samirbous @imays11 @terrancedejesus @tradebot-elastic