AWS EC2 Vulnerable XZ Image Launched

Description

Detects EC2 instances launched using Amazon Machine Images containing vulnerable XZ Utils library versions (5.6.0 or 5.6.1) affected by CVE-2024-3094. This critical supply chain vulnerability introduced a backdoor allowing remote attackers to bypass SSH authentication on affected Linux systems. The rule monitors CloudTrail RunInstances events and checks AMI IDs against known vulnerable images.

Query · python

from panther_aws_helpers import aws_cloudtrail_success, aws_rule_context
from panther_iocs import XZ_AMIS

# AMIs published by Fedora between 2024-03-26 and 2024-04-02
# OpenSUSE and Kali do not have any recent [public] AMIs that would be affected


def rule(event):
    if not aws_cloudtrail_success(event) or event.get("eventName") != "RunInstances":
        return False

    amis_launched = event.deep_walk(
        "responseElements",
        "instancesSet",
        "items",
        "imageId",
        default="<AMI ID not found>",
        return_val="all",
    )
    # convert to a list if only one item is returned
    if not isinstance(amis_launched, list):
        amis_launched = [amis_launched]
    if any(ami in XZ_AMIS for ami in amis_launched):
        return True

    return False


def title(event):
    amis_launched = event.deep_walk(
        "responseElements",
        "instancesSet",
        "items",
        "imageId",
        default="<AMI ID not found>",
        return_val="all",
    )
    instance_ids = event.deep_walk(
        "responseElements",
        "instancesSet",
        "items",
        "instanceId",
        default="<Instance ID not found>",
        return_val="all",
    )
    return f"Instance {instance_ids} launched with vulnerable AMI: {amis_launched}"


def alert_context(event):
    return aws_rule_context(event)

Analyst notes

Query CloudTrail for all RunInstances events using the same responseElements.instancesSet.items.imageId across all regions in the 30 days before this alert to identify other instances launched with vulnerable XZ AMIs
For the launched instance ID in responseElements.instancesSet.items.instanceId, verify the XZ Utils version using AWS Systems Manager Session Manager by running xz --version to confirm if version 5.6.0 or 5.6.1 is installed
Review CloudTrail logs for userIdentity.arn in the 24 hours before the launch to determine if this was automated infrastructure deployment or manual execution, and check for other suspicious API calls from the same principal

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: High
Status: Stable
Query type: python
Created: 2024-04-02
Modified: 2026-02-13
Authored by: panther-labs
Source ID
Upstream: rules/aws_cloudtrail_rules/aws_ec2_vulnerable_xz_image_launched.yml
Type: rule
Version: 3
References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3094
Data sources: AWS.CloudTrail

ATT&CK

TA0001 T1195.001