AWS SSO Access Token Retrieved by Unauthenticated IP

Description

When using AWS in an enterprise environment, best practices dictate to use a single sign-on service for identity and access management. AWS SSO is a popular solution, integrating with third-party providers such as Okta and allowing to centrally manage roles and permissions in multiple AWS accounts.

In this post, we demonstrate that AWS SSO is vulnerable by design to device code authentication phishing – just like any identity provider implementing OpenID Connect device code authentication. This technique was first demonstrated by Dr. Nestori Syynimaa for Azure AD. The feature provides a powerful phishing vector for attackers, rendering ineffective controls such as MFA (including Yubikeys) or IP allow-listing at the IdP level.

Query

Detection:
    - Group:
        - ID: Absent CLI Prompt
          RuleID: Sign-in.with.AWS.CLI.prompt
          Absence: true
        - ID: SSO Access Token Retrieved
          RuleID: Retrieve.SSO.access.token
      MatchCriteria:
        field_name:
          - GroupID: Absent CLI Prompt
            Match: sourceIPAddress
          - GroupID: SSO Access Token Retrieved
            Match: sourceIPAddress
      Schedule:
        RateMinutes: 1440
        TimeoutMinutes: 5
      LookbackWindowMinutes: 1800

Rule dependencies

⚠ Higher-order rule. It fires on other rules' alerts, not on raw events, so it cannot fire on its own. Deploy the rules it depends on too.

Depends on

Excludes

  • Sign-in.with.AWS.CLI.prompt — excluded, not a dependency
Raw source AWS SSO Access Token Retrieved by Unauthenticated IP · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: correlation_rule
RuleID: "AWS.SSO.Access.Token.Retrieved.by.Unauthenticated.IP.Group"
DisplayName: "AWS SSO Access Token Retrieved by Unauthenticated IP"
Enabled: false
Severity: Medium
Description: |-
    When using AWS in an enterprise environment, best practices dictate to use a single sign-on service for identity and access management. AWS SSO is a popular solution, integrating with third-party providers such as Okta and allowing to centrally manage roles and permissions in multiple AWS accounts.

    In this post, we demonstrate that AWS SSO is vulnerable by design to device code authentication phishing – just like any identity provider implementing OpenID Connect device code authentication. This technique was first demonstrated by Dr. Nestori Syynimaa for Azure AD. The feature provides a powerful phishing vector for attackers, rendering ineffective controls such as MFA (including Yubikeys) or IP allow-listing at the IdP level.
Reference: https://blog.christophetd.fr/phishing-for-aws-credentials-via-aws-sso-device-code-authentication/
Detection:
    - Group:
        - ID: Absent CLI Prompt
          RuleID: Sign-in.with.AWS.CLI.prompt
          Absence: true
        - ID: SSO Access Token Retrieved
          RuleID: Retrieve.SSO.access.token
      MatchCriteria:
        field_name:
          - GroupID: Absent CLI Prompt
            Match: sourceIPAddress
          - GroupID: SSO Access Token Retrieved
            Match: sourceIPAddress
      Schedule:
        RateMinutes: 1440
        TimeoutMinutes: 5
      LookbackWindowMinutes: 1800
Tests:
  - Name: AWS SSO Access Token Retrieved by Authenticated IP
    ExpectedResult: false
    RuleOutputs:
    - ID: Absent CLI Prompt
      Matches:
        sourceIPAddress:
          "1.2.3.4":
            - 0
    - ID: SSO Access Token Retrieved
      Matches:
        sourceIPAddress:
          "1.2.3.4":
            - 2
  - Name: AWS SSO Access Token Retrieved by Unauthenticated IP
    ExpectedResult: true
    RuleOutputs:
    - ID: SSO Access Token Retrieved
      Matches:
        sourceIPAddress:
          "1.2.3.4":
            - 2

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.