AWS IAM Roles Anywhere Trust Anchor Created with External CA
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Identifies when an AWS IAM Roles Anywhere Trust Anchor with an external certificate authority is created. AWS Roles Anywhere profiles are legitimate profiles that can be created by administrators to allow access from any location. This rule detects when a trust anchor is created with an external certificate authority that is not managed by AWS Certificate Manager Private Certificate Authority (ACM PCA). Adversaries may accomplish this to maintain persistence in the environment.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "DETECTION_ACTION_AWS_IAM_TRUST_ANCHOR_CREATED" AND (REQUESTPARAMETERS notcontains "sourceType:AWS_ACM_PCA") select Action1.CALLER,Action1.HOSTNAME,Action1.IPADDRESS,Action1.LOG_EVENT_NAME,Action1.SOURCE,Action1.SOURCE_REGION,Action1.REQUESTPARAMETERS
Detection
Execution Mode
realtime
Log Sources
AWS
