AWS ECS CreateCluster API calls in multiple regions

문서 > Datadog 보안 > OOTB Rules > AWS ECS CreateCluster API calls in multiple regions

Classification:

attack

Tactic:

TA0040-impact

Technique:

T1496-resource-hijacking

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Goal

Detect when there is an attempt to create AWS ECS clusters in multiple regions.

Strategy

Monitor CloudTrail and detect when an attempt to create AWS ECS clusters in multiple regions occurs. An attacker may use ECS clusters as a means of creating easily scalable resources to mine cryptocurrency. See the following Datadog Security Labs blog post for further detail.

Triage and response

Determine if {{@userIdentity.arn}} should have carried out this operation.
If the API calls were not made by the user:

Rotate user credentials.
Remove the newly created cluster {{@requestParameters.clusterName}} and any associated tasks or services.
Determine what other API calls were made by the user.
Begin your organization’s incident response process and investigate.