AWS ECS Task Definition That Queries The Credential Endpoint

Title: AWS ECS Task Definition That Queries The Credential Endpoint
Status: test
Description:Detects when an Elastic Container Service (ECS) Task Definition includes a command to query the credential endpoint. This can indicate a potential adversary adding a backdoor to establish persistence or escalate privileges.
References:
  -https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/ecs__backdoor_task_def/main.py
  -https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_RegisterTaskDefinition.html
  -https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html
Author: Darin Smith
Date: 2022-06-07
modified:2023-04-24
Tags:

• -'attack.persistence'
• -'attack.t1525'

Logsource:

• product: aws
• service: cloudtrail

Detection:
  selection:
    eventSource: 'ecs.amazonaws.com'
    eventName:
      -'DescribeTaskDefinition'
      -'RegisterTaskDefinition'
      -'RunTask'

    requestParameters.containerDefinitions.command|contains: '$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI'
  condition:selection
Falsepositives:
  -Task Definition being modified to request credentials from the Task Metadata Service for valid reasons
Level: medium