Detect Cloud API in CrowdStrike LogScale
Adversaries may abuse cloud APIs to execute malicious commands. APIs available in cloud environments provide various functionalities and are a feature-rich method for programmatic access to nearly all aspects of a tenant. These APIs may be utilized through CLIs (aws, az, gcloud), in-browser Cloud Shells, PowerShell modules, or SDKs. With proper permissions, adversaries may abuse cloud APIs to invoke functions across compute, storage, IAM, networking, and security services. APT29 has leveraged the Microsoft Graph API, TeamTNT has used AWS CLI with compromised credentials, and Storm-0501 has used cloud CLI for data exfiltration.
MITRE ATT&CK
- Tactic
- Execution
- Technique
- T1059 Command and Scripting Interpreter
- Sub-technique
- T1059.009 Cloud API
- Canonical reference
- https://attack.mitre.org/techniques/T1059/009/
LogScale Detection Query
#kind = "CloudAuditActivity"
| eventName != ""
| eventName = /CreateUser|AttachUserPolicy|CreateAccessKey|CreateRole|AssumeRole|GetSessionToken|PutBucketPolicy|DeleteBucketPolicy|CreateFunction|UpdateFunctionCode|RunInstances|CreateKeyPair|StopLogging|DeleteTrail|PutEventSelectors|DisableGuardDuty|DeleteDetector|CreateGroup|AddMemberToGroup/
| iamChange := case {
eventName = /CreateUser|AttachUserPolicy|CreateAccessKey|CreateRole/ => 1 ;
* => 0
}
| securityDisable := case {
eventName = /StopLogging|DeleteTrail|PutEventSelectors|DisableGuardDuty|DeleteDetector/ => 1 ;
* => 0
}
| privEsc := case {
eventName = /AssumeRole|AttachUserPolicy/ => 1 ;
* => 0
}
| computeCreate := case {
eventName = /RunInstances|CreateFunction|UpdateFunctionCode/ => 1 ;
* => 0
}
| suspicionScore := iamChange * 2 + securityDisable * 3 + privEsc * 2 + computeCreate
| suspicionScore > 0
| groupBy(
[eventName, userIdentity, sourceIPAddress, awsRegion, cloudProvider],
function=[
count(as=eventCount),
max(field=suspicionScore, as=maxScore),
collect(field=errorCode, limit=10)
]
)
| sort(maxScore, order=desc)CrowdStrike LogScale query detecting suspicious cloud API activity from Falcon Horizon cloud audit telemetry ingested via the Falcon Cloud Security module. Implements weighted suspicion scoring equivalent to the Splunk detection — security control disabling scores highest (3x weight), IAM changes and privilege escalation score 2x, and compute provisioning scores 1x. Results are grouped by actor identity and API action to surface high-frequency abuse patterns and reveal the full scope of activity per identity.
Data Sources
Required Tables
False Positives & Tuning
- Falcon Horizon reports legitimate AssumeRole events from cross-account access patterns used by centralized security tooling or AWS Organizations management accounts — add these known role ARNs to a suppression list in the Falcon console
- Automated remediation rules in Falcon Cloud Security may themselves trigger RunInstances or UpdateFunctionCode API calls when auto-remediating misconfigurations, creating feedback loop detections that should be filtered by the Falcon service principal identity
- CI/CD pipeline service accounts with overly broad IAM permissions generate IAM-related API calls during normal deployment cycles — apply allowlisting on userIdentity for known deployment automation accounts to reduce noise
Other platforms for T1059.009
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1AWS IAM User Enumeration via CLI
Expected signal: CloudTrail: ListUsers API call with source IP, user identity ARN, and user agent showing 'aws-cli'. The event will be logged regardless of success or failure.
- Test 2Azure Role Assignment Enumeration
Expected signal: Azure Activity Log: Microsoft.Authorization/roleAssignments/read operation. Sign-in log showing authentication event for the Azure CLI client.
- Test 3AWS CloudTrail Status Check
Expected signal: CloudTrail: GetTrailStatus API call. This read-only call is benign but its presence before StopLogging calls is a strong indicator pattern.
References (6)
- https://attack.mitre.org/techniques/T1059/009/
- https://github.com/Azure/azure-powershell
- https://docs.aws.amazon.com/cli/latest/reference/
- https://cloud.google.com/sdk/gcloud/reference
- https://github.com/RhinoSecurityLabs/pacu
- https://www.microsoft.com/en-us/security/blog/2023/07/11/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/
Unlock Pro Content
Get the full detection package for T1059.009 including response playbook, investigation guide, and atomic red team tests.