mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Patrick Bareiss
65 lines
3.0 KiB
YAML
65 lines
3.0 KiB
YAML
category:
|
|
- Cloud Security
|
|
channel: ESCU
|
|
creation_date: '2018-03-08'
|
|
description: Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining.
|
|
New instances that originate from previously unseen regions, users who launch abnormally
|
|
high numbers of instances, or EC2 instances started by previously unseen users are
|
|
just a few examples of potentially malicious behavior.
|
|
detections:
|
|
- detection_id: ada0f478-84a8-4641-a3f3-d82362d6fd75
|
|
name: EC2 Instance Started In Previously Unseen Region
|
|
type: splunk
|
|
- detection_id: 2a9b80d3-6340-4345-b5ad-290bf5d0dac4
|
|
name: Abnormally High AWS Instances Launched by User
|
|
type: splunk
|
|
- detection_id: 65541c80-03c7-4e05-83c8-1dcd57a2e1ad
|
|
name: EC2 Instance Started With Previously Unseen Instance Type
|
|
type: splunk
|
|
- detection_id: 347ec301-601b-48b9-81aa-9ddf9c829dd3
|
|
name: EC2 Instance Started With Previously Unseen AMI
|
|
type: splunk
|
|
- detection_id: 22773e84-bac0-4595-b086-20d3f735b4f1
|
|
name: EC2 Instance Started With Previously Unseen User
|
|
type: splunk
|
|
id: ced74200-8465-4bc3-bd2c-9a782eec6750
|
|
maintainers:
|
|
- company: Splunk
|
|
email: davidd@splunk.com
|
|
name: David Dorsey
|
|
modification_date: '2018-03-08'
|
|
name: AWS Cryptomining
|
|
narrative: 'Cryptomining is an intentionally difficult, resource-intensive business.
|
|
Its complexity was designed into the process to ensure that the number of blocks
|
|
mined each day would remain steady. So, it''s par for the course that ambitious,
|
|
but unscrupulous, miners make amassing the computing power of large enterprises--a
|
|
practice known as cryptojacking--a top priority. \
|
|
|
|
Cryptojacking has attracted an increasing amount of media attention since its explosion
|
|
in popularity in the fall of 2017. The attacks have moved from in-browser exploits
|
|
and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS).
|
|
It''s difficult to determine exactly how widespread the practice has become, since
|
|
bad actors continually evolve their ability to escape detection, including employing
|
|
unlisted endpoints, moderating their CPU usage, and hiding the mining pool''s IP
|
|
address behind a free CDN. \
|
|
|
|
hen malicious miners appropriate a cloud instance, often spinning up hundreds of
|
|
new instances, the costs can become astronomical for the account holder. So, it
|
|
is critically important to monitor your systems for suspicious activities that could
|
|
indicate that your network has been infiltrated. \
|
|
|
|
This Analytic Story is focused on detecting suspicious new instances in your EC2
|
|
environment to help prevent such a disaster. It contains detection searches that
|
|
will detect when a previously unused instance type or AMI is used. It also contains
|
|
support searches to build lookup files to ensure proper execution of the detection
|
|
searches.'
|
|
original_authors:
|
|
- company: Splunk
|
|
email: davidd@splunk.com
|
|
name: David Dorsey
|
|
references:
|
|
- https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf
|
|
spec_version: 2
|
|
usecase: Security Monitoring
|
|
version: '1.0'
|