Sigma rule: Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure

Rule

Title

Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure

Status

test

Level

high

Author

jamesc-grafana

Date

2024-07-11

File

rules/cloud/aws/cloudtrail/aws_cloudtrail_imds_malicious_usage.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects when an instance identity has taken an action that isn't inside SSM.
This can indicate that a compromised EC2 instance is being used as a pivot point.

Log source

product

aws

service

cloudtrail

Detection

selection:
    userIdentity.arn|re: '.+:assumed-role/aws:.+'
filter_main_generic:
    - eventSource: 'ssm.amazonaws.com'
    - eventName: 'RegisterManagedInstance'
    - sourceIPAddress: 'AWS Internal'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• A team has configured an EC2 instance to use instance profiles that grant the option for the EC2 instance to talk to other AWS Services

Tags

• attack.privilege-escalation
• attack.initial-access
• attack.persistence
• attack.stealth
• attack.t1078
• attack.t1078.002

MITRE ATT&CK ids this rule names

• T1078
• T1078.002

References

• https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-identity-roles.html
• https://ermetic.com/blog/aws/aws-ec2-imds-what-you-need-to-know/
• https://www.packetmischief.ca/2023/07/31/amazon-ec2-credential-exfiltration-how-it-happens-and-how-to-mitigate-it/#lifting-credentials-from-imds-this-is-why-we-cant-have-nice-things

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/cloud/aws/cloudtrail/aws_cloudtrail_imds_malicious_usage.yml