Wazuh detects AWS access key compromise by correlating CloudTrail and GuardDuty telemetry across validation, enumeration, persistence, and exfiltration stages. The article explains how attackers abuse exposed AWS access keys and how Wazuh rules can reconstruct the compromise chain to raise a high-confidence alert. #Wazuh #CloudTrail #GuardDuty #AWSCompromisedKeyQuarantineV2
Keypoints
- AWS access keys can be abused when exposed in public repositories, build pipelines, credential files, or compromised devices.
- CloudTrail provides the main API activity telemetry, while GuardDuty adds findings for suspicious behavior and exfiltration indicators.
- Wazuh ingests AWS telemetry from S3, decodes it, and correlates related events to identify an active compromise chain.
- The attack chain is modeled in four stages: validation, enumeration, persistence, and exfiltration.
- Custom Wazuh rules detect untrusted key validation, repeated AccessDenied enumeration, persistence attempts, and GuardDuty findings.
- Correlation rules 101604 and 101605 link validation and persistence in either order, producing a high-confidence compromise alert.
- The article also shows how to emulate the attack, verify alerts in the Wazuh dashboard, and apply preventive AWS controls such as IAM roles, SCPs, key rotation, and AWSCompromisedKeyQuarantineV2.
MITRE Techniques
- [T1078.004 ] Valid Accounts: Cloud Accounts – Used when a stolen AWS access key is validated with sts:GetCallerIdentity or sts:GetSessionToken from an unrecognized IP (‘Access key validated from unrecognized IP’).
- [T1580 ] Cloud Infrastructure Discovery – Used during enumeration as the attacker probes AWS resources with read-only calls like iam:ListUsers and s3:ListBuckets (‘burst of read-only discovery calls’).
- [T1087.004 ] Account Discovery: Cloud Account – Used when the attacker lists users and roles to learn what identities exist (‘iam:ListUsers, iam:ListRoles’).
- [T1069.003 ] Permission Groups Discovery: Cloud Groups – Used when repeated denied requests reveal what permissions are available through probing (‘collects AccessDenied errors while probing permissions’).
- [T1098.001 ] Additional Cloud Credentials – Used when the attacker attempts persistence by creating backup credentials or new identities (‘CreateAccessKey, CreateUser, or AttachUserPolicy’).
- [T1552 ] Unsecured Credentials – Used in the context of credential exfiltration or anomalous use flagged by GuardDuty (‘Credential exfiltration or anomalous behavior detected’).
Indicators of Compromise
- [AWS S3 bucket names ] log storage and log export targets – , s3-iam-logbucket
- [AWS KMS key identifier ] GuardDuty findings encryption and Wazuh decryption –
- [AWS region ] deployment and KMS/S3 configuration –
- [AWS account ID ] used in bucket, KMS, and policy statements –
- [IAM usernames ] Wazuh integration and attacker/victim identities – , iam-compromise-victim-test
- [File paths ] Wazuh AWS credentials, lists, rules, and logs – /root/.aws/credentials, /var/ossec/etc/lists/trusted_aws_ips, /var/ossec/etc/rules/aws_iam_compromise_rules.xml
- [AWS CLI commands ] attack emulation and GuardDuty sample finding generation – aws sts get-caller-identity, aws iam create-access-key, aws guardduty create-sample-findings
- [Access key artifacts ] attacker and integration credentials used for AWS API access – ,
Read more: https://wazuh.com/blog/detecting-aws-access-key-compromise-with-wazuh/