AWS EC2 Multi-Region DescribeInstances API Calls

Last updated 14 days ago on 2024-11-07
Created 3 months ago on 2024-08-26

About

Identifies when a single AWS resource is making `DescribeInstances` API calls in more than 10 regions within a 30-second window. This could indicate a potential threat actor attempting to discover the AWS infrastructure across multiple regions using compromised credentials or a compromised instance. Adversaries may use this information to identify potential targets for further exploitation or to gain a better understanding of the target's infrastructure.
Tags
Domain: CloudData Source: AWSData Source: AWS EC2Use Case: Threat DetectionTactic: Discovery
Severity
low
Risk Score
21
MITRE ATT&CK™

Discovery (TA0007)(opens in a new tab or window)

False Positive Examples
Legitimate use of the `DescribeInstances` API call by an AWS resource that requires information about instances in multiple regions. Scheduled tasks or scripts that require information about instances in multiple regions.
License
Elastic License v2(opens in a new tab or window)

Definition

Integration Pack
Prebuilt Security Detection Rules
Related Integrations

aws(opens in a new tab or window)

Query
from logs-aws.cloudtrail-*

// filter for DescribeInstances API calls
| where event.dataset == "aws.cloudtrail" and event.provider == "ec2.amazonaws.com" and event.action == "DescribeInstances"

// truncate the timestamp to a 30-second window
| eval target_time_window = DATE_TRUNC(30 seconds, @timestamp)

// keep only the relevant fields
| keep target_time_window, aws.cloudtrail.user_identity.arn, cloud.region

// count the number of unique regions and total API calls within the 30-second window
| stats region_count = count_distinct(cloud.region), window_count = count(*) by target_time_window, aws.cloudtrail.user_identity.arn

// filter for resources making DescribeInstances API calls in more than 10 regions within the 30-second window
| where region_count >= 10 and window_count >= 10

// sort the results by time windows in descending order
| sort target_time_window desc

Install detection rules in Elastic Security

Detect AWS EC2 Multi-Region DescribeInstances API Calls in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(opens in a new tab or window).