aws_exfiltration_via_datasync_task.yml

name: AWS Exfiltration via DataSync Task
id: 05c4b09f-ea28-4c7c-a7aa-a246f665c8a2
version: 1
date: '2023-04-10'
author: Bhavin Patel, Splunk
status: production
type: TTP
data_source: []
description: This search looks for potential misuse of an AWS service known as DataSync. This AWS service is used to transfer data between different AWS cloud storage services, such as Amazon S3, Amazon EFS, and Amazon FSx for Windows File Server. Attackers can create a task in AWS to periodically copy data from a private AWS location to a public location resulting in the compromise of the data.  
search: '`cloudtrail` eventName = CreateTask eventSource="datasync.amazonaws.com" | rename  requestParameters.*  as *  | stats count min(_time) as firstTime max(_time) as lastTime by src_ip aws_account_id awsRegion eventName destinationLocationArn sourceLocationArn userAgent user_arn userIdentity.principalId  errorCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_exfiltration_via_datasync_task_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
  search works with AWS CloudTrail logs.
known_false_positives: It is possible that an AWS Administrator has legitimately created this task for creating backup. Please check the `sourceLocationArn` and `destinationLocationArn` of this task
references:
- https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
- https://www.shehackske.com/how-to/data-exfiltration-on-cloud-1606/
tags:
  analytic_story:
  - Suspicious AWS S3 Activities
  - Data Exfiltration
  asset_type: AWS Account
  confidence: 80
  impact: 80
  message: DataSync task created on account id - $aws_account_id$ by user $user_arn$ from src_ip $src_ip$
  mitre_attack_id:
  - T1119
  observable:
  - name: user_arn
    type: User
    role:
    - Attacker
  - name: src_ip
    type: IP Address
    role:
    - Attacker
  - name: aws_account_id
    type: Other
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - eventName
  - user_arn
  - src_ip
  - aws_account_id
  - destinationLocationArn
  - sourceLocationArn
  - userAgent
  - userIdentity.principalId
  risk_score: 64
  security_domain: threat
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1119/aws_exfil_datasync/cloudtrail.json
    sourcetype: aws:cloudtrail
    source: aws_cloudtrail
    update_timestamp: true