From c3b028b04128f758496994a45c9290c136debb36 Mon Sep 17 00:00:00 2001 From: Isai <59296946+imays11@users.noreply.github.com> Date: Thu, 23 Oct 2025 14:54:34 -0400 Subject: [PATCH 1/6] [Rule Tuning] AWS EC2 Full Network Packet Capture Detected **AWS EC2 Full Network Packet Capture Detected** Alert telemetry is low in general however the alerts that do exist are unnecessarily duplicative in nature. When a traffic mirror session is created (CreateTrafficMirrorSession), it is typcially created alongside A filter and filter rules (CreateTrafficMirrorFilter, CreateTrafficMirrorFilterRule) which determines what traffic will be mirrored. There is also a traffic mirror target (CreateTrafficMirrorTarget), which is the destination for the mirrored traffic to go. The original scope of this rule included all of those APIs when really the only API needed here is `CreateTrafficMirrorSession`, which is the actual network mirroring behavior. The rest of those calls can be used as additional context during alert triage, but I've significantly reduced the scope of this rule to only capture the actual traffic mirroring behavior. - reduced the query scope to `CreateTrafficMirrorSession` only - reduced the execution window - update description and investigation guide - replaced API reference link - added highlighted fields --- ..._full_network_packet_capture_detected.toml | 119 +++++++++++++----- 1 file changed, 85 insertions(+), 34 deletions(-) diff --git a/rules/integrations/aws/exfiltration_ec2_full_network_packet_capture_detected.toml b/rules/integrations/aws/exfiltration_ec2_full_network_packet_capture_detected.toml index c5db0b08241..186e7235a1c 100644 --- a/rules/integrations/aws/exfiltration_ec2_full_network_packet_capture_detected.toml +++ b/rules/integrations/aws/exfiltration_ec2_full_network_packet_capture_detected.toml @@ -2,14 +2,15 @@ creation_date = "2021/05/05" integration = ["aws"] maturity = "production" -updated_date = "2025/01/15" +updated_date = "2025/10/23" [rule] author = ["Elastic", "Austin Songer"] description = """ -Identifies potential Traffic Mirroring in an Amazon Elastic Compute Cloud (EC2) instance. Traffic Mirroring is an Amazon -VPC feature that you can use to copy network traffic from an Elastic network interface. This feature can potentially be -abused to exfiltrate sensitive data from unencrypted internal traffic. +Detects successful creation of an Amazon EC2 Traffic Mirroring session. A session copies full packets from a source +Elastic Network Interface (ENI) to a mirror target (e.g., an ENI or NLB) using a mirror filter (ingress/egress rules). +While used for diagnostics and NDR/IDS tooling, adversaries can abuse sessions to covertly capture and exfiltrate +sensitive, potentially unencrypted, traffic from instances or subnets. """ false_positives = [ """ @@ -18,9 +19,8 @@ false_positives = [ should be investigated. If known behavior is causing false positives, it can be exempted from the rule. """, ] -from = "now-60m" +from = "now-6m" index = ["filebeat-*", "logs-aws.cloudtrail-*"] -interval = "10m" language = "kuery" license = "Elastic License v2" name = "AWS EC2 Full Network Packet Capture Detected" @@ -31,40 +31,72 @@ note = """## Triage and analysis ### Investigating AWS EC2 Full Network Packet Capture Detected -Traffic Mirroring in AWS EC2 allows copying of network traffic for monitoring and analysis, crucial for security and performance insights. However, adversaries can exploit this by capturing unencrypted data, leading to potential data exfiltration. The detection rule identifies successful creation of traffic mirroring components, signaling possible misuse for unauthorized data collection. - -### Possible investigation steps - -- Review the CloudTrail logs for the specific event actions: CreateTrafficMirrorFilter, CreateTrafficMirrorFilterRule, CreateTrafficMirrorSession, and CreateTrafficMirrorTarget to identify the user or role that initiated these actions. -- Check the event.outcome field to confirm the success of the traffic mirroring setup and gather details about the time and source IP address of the request. -- Investigate the associated Elastic Network Interface (ENI) to determine which EC2 instance is involved and assess its role and importance within the network. -- Analyze the network traffic patterns and data flow from the mirrored traffic to identify any signs of data exfiltration or unusual data transfer activities. -- Verify the encryption status of the network traffic being mirrored to assess the risk of sensitive data exposure. -- Cross-reference the involved AWS account and IAM roles with known threat actor profiles or previous security incidents to identify potential insider threats or compromised accounts. +This alert fires on a successful `CreateTrafficMirrorSession`, which enables full-packet Traffic Mirroring from a +source ENI to a mirror target under a given filter. Because sessions immediately begin sending packets once active, +treat unexpected creations as high priority. + +#### Possible investigation steps + +**Identify the actor and execution context** +- **Principal**: Review `aws.cloudtrail.user_identity.arn`, `aws.cloudtrail.user_identity.type`, and + `aws.cloudtrail.user_identity.access_key_id` to determine who created the session (human IAM user vs. assumed role vs. automation). +- **Caller metadata**: Check `user_agent.original`, and `source.ip` for unusual tools, hosts, or locations. +- **Account/Region/Time**: Validate `cloud.account.id`, `cloud.region`, and `@timestamp` against change windows or tickets. + +**Extract the session details from the event** +- **Request parameters**: Parse `aws.cloudtrail.request_parameters` for: + - `NetworkInterfaceId` (mirrored source ENI) map to the EC2 instance and its business function. + - `TrafficMirrorTargetId` identify where packets are being sent (ENI vs. NLB). + - `TrafficMirrorFilterId` check which directions and protocols are allowed (ingress/egress, ports). + - `SessionNumber`, `Description`, `TagSpecifications` look for operator tags or suspicious notes. +- **Response elements**: Use `aws.cloudtrail.response_elements` to confirm the created `TrafficMirrorSessionId` and + any resolved resource ARNs/IDs. + +**Pivot for related API calls to validate scope and intent** +Look before and after this event (±30–60 minutes) by the same principal / access key / source IP for: +- **Target & Filter lifecycle**: `CreateTrafficMirrorTarget`, `CreateTrafficMirrorFilter`, `CreateTrafficMirrorFilterRule`, + `ModifyTrafficMirrorSession|Filter|FilterRule`, and `Delete*` calls (rapid create-modify patterns can indicate staging). +- **Session management**: `DeleteTrafficMirrorSession` shortly after creation (test/probe), or repeated creations to different targets. +- **Discovery/positioning**: `DescribeNetworkInterfaces`, `DescribeInstances`, `DescribeVpcs/Subnets/RouteTables` around the same time. +- **Cross-account indicators**: creation of targets that forward to infrastructure not owned by your account (e.g., NLB in shared services). +- **Other suspicious changes**: IAM permission changes, new access keys, or S3/SNS setup that could support exfil/ops. + +**Validate the mirror destination and potential data exposure** +- If the target is an ENI: identify the owning instance/application; confirm it is an approved NDR/packet capture host. +- If the target is an NLB target: determine where the NLB sends traffic (could be a collection point in another VPC or account). +- Assess whether mirrored flows include plaintext protocols (internal HTTP, databases, LDAP, etc.) increasing sensitivity. ### False positive analysis -- Routine network monitoring activities may trigger the rule if legitimate traffic mirroring is set up for performance analysis. To manage this, identify and document authorized traffic mirroring configurations and exclude them from alerts. -- Security audits or compliance checks might involve creating traffic mirroring sessions. Coordinate with audit teams to schedule these activities and temporarily suppress alerts during these periods. -- Development and testing environments often use traffic mirroring for debugging purposes. Maintain a list of such environments and apply exceptions to avoid unnecessary alerts. -- Automated infrastructure management tools might create traffic mirroring components as part of their operations. Review and whitelist these tools to prevent false positives. -- Ensure that any third-party services with access to your AWS environment are vetted and their activities are monitored to distinguish between legitimate and suspicious traffic mirroring actions. +- **Authorized monitoring**: Approved NDR/IDS tooling or troubleshooting playbooks may legitimately create sessions. +- **Ops/diagnostics**: Short-lived sessions during incident handling or performance analysis. +- **Automation**: Infrastructure pipelines that stand up temporary mirroring for validation. ### Response and remediation -- Immediately isolate the affected EC2 instance to prevent further data exfiltration. This can be done by removing the instance from any network access or security groups that allow outbound traffic. -- Review and terminate any unauthorized Traffic Mirroring sessions, filters, or targets that were created. Ensure that only legitimate and necessary mirroring configurations are active. -- Conduct a thorough audit of the AWS CloudTrail logs to identify any other suspicious activities or unauthorized access attempts related to Traffic Mirroring or other sensitive operations. -- Rotate and update any credentials or access keys that may have been exposed or compromised during the incident to prevent further unauthorized access. -- Notify the security team and relevant stakeholders about the incident for awareness and further investigation. Escalate to higher management if the data exfiltration involves sensitive or critical data. -- Implement additional network monitoring and intrusion detection measures to enhance visibility and detect similar threats in the future. Consider using AWS GuardDuty or similar services for continuous threat detection. -- Review and update security policies and access controls to ensure that Traffic Mirroring and other sensitive features are only accessible to authorized personnel with a legitimate need. +**1. Contain** +- If unauthorized, terminate the session immediately (use the `TrafficMirrorSessionId` from `aws.cloudtrail.response_elements`) + and block creation permissions for the offending principal. +- Quarantine or restrict egress from the target if you suspect it is forwarding captured traffic outside approved destinations. + +**2. Investigate** +- Enumerate all active sessions in the affected account/region; verify there aren’t additional rogue sessions. +- Review related target and filter resources (and recent `Modify*` calls) to understand captured scope and recipients. +- Trace the source ENI back to the EC2 instance and validate whether sensitive workloads were mirrored. + +**3. Recover & harden** +- Remove or lock down unapproved targets/filters; enforce least privilege on `ec2:CreateTrafficMirrorSession/Target/Filter`. +- Consider SCPs or IAM conditions limiting who/where sessions can be created (e.g., only into designated monitoring VPCs). +- Ensure monitoring targets are controlled, logged, and not internet-reachable. -## Setup +**4. Improve** +- Add correlation logic to automatically surface CreateTrafficMirrorSession alongside Create/Modify Target/Filter calls by the same actor. +- Require tags on approved mirroring resources; alert on untagged/unticketed creations. +- Update playbooks to include a standard validation checklist (principal, source ENI, target, filter rules, destination path). -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.""" +""" references = [ - "https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_TrafficMirrorFilter.html", + "https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_TrafficMirrorSession.html", "https://github.com/easttimor/aws-incident-response", ] risk_score = 47 @@ -83,9 +115,10 @@ timestamp_override = "event.ingested" type = "query" query = ''' -event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and -event.action:(CreateTrafficMirrorFilter or CreateTrafficMirrorFilterRule or CreateTrafficMirrorSession or CreateTrafficMirrorTarget) and -event.outcome:success +event.dataset: aws.cloudtrail and + event.provider: ec2.amazonaws.com and + event.action: CreateTrafficMirrorSession and + event.outcome: success ''' @@ -114,3 +147,21 @@ id = "TA0009" name = "Collection" reference = "https://attack.mitre.org/tactics/TA0009/" +[rule.investigation_fields] +field_names = [ + "@timestamp", + "user.name", + "user_agent.original", + "source.ip", + "aws.cloudtrail.user_identity.arn", + "aws.cloudtrail.user_identity.type", + "aws.cloudtrail.user_identity.access_key_id", + "target.entity.id", + "event.action", + "event.outcome", + "cloud.account.id", + "cloud.region", + "aws.cloudtrail.request_parameters", + "aws.cloudtrail.response_elements", +] + From 6d22df4c4364643fffc8cc5c05871c60bd3fbec5 Mon Sep 17 00:00:00 2001 From: Isai <59296946+imays11@users.noreply.github.com> Date: Thu, 23 Oct 2025 15:15:52 -0400 Subject: [PATCH 2/6] updating mitre technique updating mitre technique --- ...on_ec2_full_network_packet_capture_detected.toml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/rules/integrations/aws/exfiltration_ec2_full_network_packet_capture_detected.toml b/rules/integrations/aws/exfiltration_ec2_full_network_packet_capture_detected.toml index 186e7235a1c..847e284fbce 100644 --- a/rules/integrations/aws/exfiltration_ec2_full_network_packet_capture_detected.toml +++ b/rules/integrations/aws/exfiltration_ec2_full_network_packet_capture_detected.toml @@ -115,10 +115,10 @@ timestamp_override = "event.ingested" type = "query" query = ''' -event.dataset: aws.cloudtrail and - event.provider: ec2.amazonaws.com and - event.action: CreateTrafficMirrorSession and - event.outcome: success +event.dataset: "aws.cloudtrail" and + event.provider: "ec2.amazonaws.com" and + event.action: "CreateTrafficMirrorSession" and + event.outcome: "success" ''' @@ -129,6 +129,11 @@ id = "T1020" name = "Automated Exfiltration" reference = "https://attack.mitre.org/techniques/T1020/" +[[rule.threat.technique]] +id = "T1537" +name = "Transfer Data to Cloud Account" +reference = "https://attack.mitre.org/techniques/T1537/" + [rule.threat.tactic] id = "TA0010" From 46ef916c4b0f47f4f1ff1431d103e1e5fc2916a9 Mon Sep 17 00:00:00 2001 From: Isai <59296946+imays11@users.noreply.github.com> Date: Thu, 23 Oct 2025 15:48:23 -0400 Subject: [PATCH 3/6] updated Mitre mapping adding network sniffing technique --- ...ion_ec2_full_network_packet_capture_detected.toml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/rules/integrations/aws/exfiltration_ec2_full_network_packet_capture_detected.toml b/rules/integrations/aws/exfiltration_ec2_full_network_packet_capture_detected.toml index 847e284fbce..54f15fe3ba2 100644 --- a/rules/integrations/aws/exfiltration_ec2_full_network_packet_capture_detected.toml +++ b/rules/integrations/aws/exfiltration_ec2_full_network_packet_capture_detected.toml @@ -151,6 +151,18 @@ reference = "https://attack.mitre.org/techniques/T1074/" id = "TA0009" name = "Collection" reference = "https://attack.mitre.org/tactics/TA0009/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1040" +name = "Network Sniffing" +reference = "https://attack.mitre.org/techniques/T1040/" + + +[rule.threat.tactic] +id = "TA0007" +name = "Discovery" +reference = "https://attack.mitre.org/tactics/TA0007/" [rule.investigation_fields] field_names = [ From 055448f7ae76acf1527fb841daa1623c44f75875 Mon Sep 17 00:00:00 2001 From: Isai <59296946+imays11@users.noreply.github.com> Date: Thu, 23 Oct 2025 15:50:04 -0400 Subject: [PATCH 4/6] updating references to include relevant threat blog updating references to include relevant threat blog --- .../exfiltration_ec2_full_network_packet_capture_detected.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/integrations/aws/exfiltration_ec2_full_network_packet_capture_detected.toml b/rules/integrations/aws/exfiltration_ec2_full_network_packet_capture_detected.toml index 54f15fe3ba2..8613af67bdd 100644 --- a/rules/integrations/aws/exfiltration_ec2_full_network_packet_capture_detected.toml +++ b/rules/integrations/aws/exfiltration_ec2_full_network_packet_capture_detected.toml @@ -97,7 +97,7 @@ Look before and after this event (±30–60 minutes) by the same principal / acc """ references = [ "https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_TrafficMirrorSession.html", - "https://github.com/easttimor/aws-incident-response", + "https://rhinosecuritylabs.com/aws/abusing-vpc-traffic-mirroring-in-aws/", ] risk_score = 47 rule_id = "c1812764-0788-470f-8e74-eb4a14d47573" From b7e4706e1f860990926553b09e80fa981a2cc494 Mon Sep 17 00:00:00 2001 From: Isai <59296946+imays11@users.noreply.github.com> Date: Thu, 23 Oct 2025 17:04:09 -0400 Subject: [PATCH 5/6] adding EC2 tag adding EC2 tag --- rules/integrations/aws/exfiltration_ec2_vm_export_failure.toml | 1 + 1 file changed, 1 insertion(+) diff --git a/rules/integrations/aws/exfiltration_ec2_vm_export_failure.toml b/rules/integrations/aws/exfiltration_ec2_vm_export_failure.toml index ca585ea59e4..c00227eed6b 100644 --- a/rules/integrations/aws/exfiltration_ec2_vm_export_failure.toml +++ b/rules/integrations/aws/exfiltration_ec2_vm_export_failure.toml @@ -68,6 +68,7 @@ tags = [ "Domain: Cloud", "Data Source: AWS", "Data Source: Amazon Web Services", + "Data Source: AWS EC2", "Use Case: Asset Visibility", "Tactic: Exfiltration", "Tactic: Collection", From 870a6bc820d00fadf1ad8f121f4abee73c7fd8cd Mon Sep 17 00:00:00 2001 From: Isai <59296946+imays11@users.noreply.github.com> Date: Mon, 27 Oct 2025 10:55:41 -0400 Subject: [PATCH 6/6] updating EC2 tagging --- .../exfiltration_ec2_full_network_packet_capture_detected.toml | 1 + rules/integrations/aws/exfiltration_ec2_vm_export_failure.toml | 1 - 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/integrations/aws/exfiltration_ec2_full_network_packet_capture_detected.toml b/rules/integrations/aws/exfiltration_ec2_full_network_packet_capture_detected.toml index 8613af67bdd..0d19f98afe5 100644 --- a/rules/integrations/aws/exfiltration_ec2_full_network_packet_capture_detected.toml +++ b/rules/integrations/aws/exfiltration_ec2_full_network_packet_capture_detected.toml @@ -106,6 +106,7 @@ tags = [ "Domain: Cloud", "Data Source: AWS", "Data Source: Amazon Web Services", + "Data Source: AWS EC2", "Use Case: Network Security Monitoring", "Tactic: Exfiltration", "Tactic: Collection", diff --git a/rules/integrations/aws/exfiltration_ec2_vm_export_failure.toml b/rules/integrations/aws/exfiltration_ec2_vm_export_failure.toml index c00227eed6b..ca585ea59e4 100644 --- a/rules/integrations/aws/exfiltration_ec2_vm_export_failure.toml +++ b/rules/integrations/aws/exfiltration_ec2_vm_export_failure.toml @@ -68,7 +68,6 @@ tags = [ "Domain: Cloud", "Data Source: AWS", "Data Source: Amazon Web Services", - "Data Source: AWS EC2", "Use Case: Asset Visibility", "Tactic: Exfiltration", "Tactic: Collection",