Loading

AWS Potential Cryptomining via ECS Task Definition Deployment

Identifies a principal that, within a short window, both registers an Amazon ECS task definition using a public / non-ECR container image at a high CPU allocation (8 or 16 vCPU) AND launches ECS workloads (RunTask, StartTask, or CreateService). Registering a public miner image at maximum compute and then launching it is the ECS/Fargate cryptocurrency-mining deployment pattern seen after credential compromise. Requiring both the mining-signature registration and a launch by the same principal confirms an actual deployment rather than a standalone (possibly benign) task-definition registration, which sharply reduces false positives from high-compute workloads that are merely registered.

Rule type: esql
Rule indices:

Rule Severity: high
Risk Score: 73
Runs every:
Searches indices from: now-30m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Cloud
  • Data Source: AWS
  • Data Source: AWS CloudTrail
  • Data Source: Amazon Web Services
  • Use Case: Threat Detection
  • Tactic: Impact
  • Resources: Investigation Guide

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2
This rule requires AWS CloudTrail logs ingested via the Elastic AWS integration. See https://docs.elastic.co/integrations/aws/cloudtrail for setup details.

Amazon ECS runs containers from images referenced in a task definition. After credential compromise, a common impact action is to abuse ECS/Fargate for cryptomining: the adversary registers a task definition pointing at a public miner image (Docker Hub, GHCR, Quay, or the public ECR gallery) at maximum CPU to maximize hashrate, then launches it at scale via RunTask/CreateService, often across multiple regions.

This rule correlates by principal within the rule window and fires only when the same identity BOTH (a) registers a task definition whose container image comes from a public registry and whose CPU is high (8-16 vCPU), AND (b) launches ECS workloads (RunTask/StartTask/CreateService). Requiring the launch in addition to the mining-signature registration confirms active deployment and distinguishes it from a task definition that is merely registered.

  • Review the RegisterTaskDefinition event's "aws.cloudtrail.request_parameters" for the container image, CPU/memory, and task family, and the launch event(s) for the cluster and desired count.
  • Identify the principal in "aws.cloudtrail.user_identity.arn"/"aws.cloudtrail.user_identity.type" and whether it normally operates ECS; review "source.ip"/"source.as.number" and "user_agent.original".
  • Correlate with related activity by the same principal: ECS "CreateCluster" (especially in unused regions), new IAM users with administrative policies, and prior reconnaissance.
  • Inspect the referenced image and any running containers/tasks and their outbound network connections (mining-pool traffic).
  • Legitimate batch/data-science workloads may both register a high-compute public-image task definition and run it. Validate the image, workload, and principal, and exclude known-good identities after confirmation.
  • If unauthorized, stop and delete the launched services/tasks, deregister the task definition, and review other regions for the same activity.
  • Investigate the principal for compromise, revoke or rotate its credentials, and review for persistence (new IAM users/policies).
  • Restrict ECS task-definition registration and task execution roles, and require images from approved private ECR repositories.
FROM logs-aws.cloudtrail-*
| WHERE event.provider == "ecs.amazonaws.com"
    AND event.action IN ("RegisterTaskDefinition", "RunTask", "StartTask", "CreateService")
| EVAL Esql.miner_register = CASE(
        event.action == "RegisterTaskDefinition"
            AND (aws.cloudtrail.request_parameters RLIKE """.*image=(docker.io|index.docker.io|ghcr.io|quay.io|public.ecr.aws)/.*"""
                OR aws.cloudtrail.request_parameters RLIKE """.*image=[-a-zA-Z0-9_]+(/|[,} :]).*""")
            AND aws.cloudtrail.request_parameters RLIKE """.*cpu=(8192|16384)[,} ].*""", 1, 0),
    Esql.task_run = CASE(event.action IN ("RunTask", "StartTask", "CreateService"), 1, 0)
| STATS Esql.miner_register_sum = SUM(Esql.miner_register), Esql.task_run_sum = SUM(Esql.task_run), Esql.event_count = COUNT(*),
        Esql.cloud_region_count_distinct = COUNT_DISTINCT(cloud.region), Esql.cloud_region_values = VALUES(cloud.region),
        Esql.event_action_values = VALUES(event.action), Esql.source_ip_values = VALUES(source.ip),
        Esql.source_as_number_values = VALUES(source.as.number), Esql.user_agent_original_values = VALUES(user_agent.original),
        Esql.cloud_account_id_values = VALUES(cloud.account.id), Esql.aws_cloudtrail_user_identity_type_values = VALUES(aws.cloudtrail.user_identity.type),
        Esql.timestamp_min = MIN(@timestamp), Esql.timestamp_max = MAX(@timestamp)
        BY aws.cloudtrail.user_identity.arn
| WHERE Esql.miner_register_sum >= 1 AND Esql.task_run_sum >= 1
| KEEP aws.*, Esql.aws_cloudtrail_user_identity_type_values, Esql.miner_register_sum, Esql.task_run_sum, Esql.event_count, Esql.cloud_region_count_distinct, Esql.cloud_region_values, Esql.event_action_values, Esql.source_ip_values, Esql.source_as_number_values, Esql.user_agent_original_values, Esql.cloud_account_id_values, Esql.timestamp_min, Esql.timestamp_max

Framework: MITRE ATT&CK