ID | Technique | Tactic |
---|---|---|
T1119 | Automated Collection | Collection |
Detection: AWS Exfiltration via DataSync Task
Description
The following analytic detects the creation of an AWS DataSync task, which could indicate potential data exfiltration. It leverages AWS CloudTrail logs to identify the CreateTask
event from the DataSync service. This activity is significant because attackers can misuse DataSync to transfer sensitive data from a private AWS location to a public one, leading to data compromise. If confirmed malicious, this could result in unauthorized access to sensitive information, causing severe data breaches and compliance violations.
Search
1`cloudtrail` eventName = CreateTask eventSource="datasync.amazonaws.com"
2| rename requestParameters.* as *
3| stats count min(_time) as firstTime max(_time) as lastTime by src_ip aws_account_id awsRegion eventName destinationLocationArn sourceLocationArn userAgent user_arn userIdentity.principalId errorCode
4| `security_content_ctime(firstTime)`
5| `security_content_ctime(lastTime)`
6| `aws_exfiltration_via_datasync_task_filter`
Data Source
Name | Platform | Sourcetype | Source |
---|---|---|---|
AWS CloudTrail CreateTask | AWS | 'aws:cloudtrail' |
'aws_cloudtrail' |
Macros Used
Name | Value |
---|---|
cloudtrail | sourcetype=aws:cloudtrail |
aws_exfiltration_via_datasync_task_filter | search * |
aws_exfiltration_via_datasync_task_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Notable | Yes |
Rule Title | %name% |
Rule Description | %description% |
Notable Event Fields | user, dest |
Creates Risk Event | True |
Implementation
You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
Known False Positives
It is possible that an AWS Administrator has legitimately created this task for creating backup. Please check the sourceLocationArn
and destinationLocationArn
of this task
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message | Risk Score | Impact | Confidence |
---|---|---|---|
DataSync task created on account id - $aws_account_id$ by user $user_arn$ from src_ip $src_ip$ | 64 | 80 | 80 |
References
-
https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
-
https://www.shehackske.com/how-to/data-exfiltration-on-cloud-1606/
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | aws_cloudtrail |
aws:cloudtrail |
Integration | ✅ Passing | Dataset | aws_cloudtrail |
aws:cloudtrail |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 3