Wiz Issue WITH SSH to EC2 Instance

Description

Wiz detected a security issue with an EC2 instance followed by an SSH connection to the instance. This sequence could indicate a potential security breach.

Query

Detection:
    - Group:
        - ID: WizIssue
          RuleID: Wiz.Alert.Passthrough
        - ID: SSH Access
          RuleID: AWS.VPC.SSHAllowedSignal
      MatchCriteria:
        field_name:
          - GroupID: WizIssue
            Match: entitySnapshot.externalId
          - GroupID: SSH Access
            Match: instanceId
      LookbackWindowMinutes: 1800
      Schedule:
        RateMinutes: 1440
        TimeoutMinutes: 5

Rule dependencies

⚠ Higher-order rule. It fires on other rules' alerts, not on raw events, so it cannot fire on its own. Deploy the rules it depends on too.

Depends on

Raw source Wiz Issue WITH SSH to EC2 Instance · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: correlation_rule
RuleID: "Wiz.Issue.WITH.SSH"
DisplayName: "Wiz Issue WITH SSH to EC2 Instance"
Enabled: false
Severity: High
Tags:
    - Configuration Required
Description: Wiz detected a security issue with an EC2 instance followed by an SSH connection to the instance. This sequence could indicate a potential security breach.
Reports:
  MITRE ATT&CK:
    - TA0008:T1021.004 # Lateral Movement: Remote Services: SSH
    - TA0001:T1133 # Initial Access: External Remote Services
Detection:
    - Group:
        - ID: WizIssue
          RuleID: Wiz.Alert.Passthrough
        - ID: SSH Access
          RuleID: AWS.VPC.SSHAllowedSignal
      MatchCriteria:
        field_name:
          - GroupID: WizIssue
            Match: entitySnapshot.externalId
          - GroupID: SSH Access
            Match: instanceId
      LookbackWindowMinutes: 1800
      Schedule:
        RateMinutes: 1440
        TimeoutMinutes: 5
Tests:
    - Name: Wiz Issue Followed By SSH
      ExpectedResult: true
      RuleOutputs:
        - ID: WizIssue
          Matches:
            entitySnapshot.externalId:
              'i-0d4c7318592c6a2c7':
                - "2024-06-01T10:00:01Z"
        - ID: SSH Access
          Matches:
            instanceId:
              'i-0d4c7318592c6a2c7':
                - "2024-06-01T10:30:01Z"
    - Name: Wiz Issue Not Followed By SSH
      ExpectedResult: false
      RuleOutputs:
        - ID: WizIssue
          Matches:
            entitySnapshot.externalId:
              'i-0d4c7318592c6a2c7':
                - "2024-06-01T10:00:01Z"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.