Sigma rule: AWS ECS Task Definition That Queries The Credential Endpoint

Rule

Title

AWS ECS Task Definition That Queries The Credential Endpoint

Status

test

Level

medium

Author

Darin Smith

Date

2022-06-07

Modified

2023-04-24

File

rules/cloud/aws/cloudtrail/aws_ecs_task_definition_cred_endpoint_query.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects when an Elastic Container Service (ECS) Task Definition includes a command to query the credential endpoint.
This can indicate a potential adversary adding a backdoor to establish persistence or escalate privileges.

Log source

product

aws

service

cloudtrail

Detection

selection:
    eventSource: 'ecs.amazonaws.com'
    eventName:
        - 'DescribeTaskDefinition'
        - 'RegisterTaskDefinition'
        - 'RunTask'
    requestParameters.containerDefinitions.command|contains: '$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI'
condition: selection

False positives (as the rule lists them)

• Task Definition being modified to request credentials from the Task Metadata Service for valid reasons

Tags

• attack.persistence
• attack.t1525

MITRE ATT&CK ids this rule names

• T1525

References

• https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/ecs__backdoor_task_def/main.py
• https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_RegisterTaskDefinition.html
• https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/cloud/aws/cloudtrail/aws_ecs_task_definition_cred_endpoint_query.yml