awslabs / amazon-guardduty-tester

This repository can be used to generate and evaluate findings detected by Amazon GuardDuty

GuardDuty Findings Tester

This repository contains scripts and guidance that can be used as a proof-of-concept to generate Amazon GuardDuty findings related to real AWS resources. There are multiple tests that can be run independently or together depending on the findings you are looking to generate. These scripts do not generate examples for every possible GuardDuty finding type but do help provide insight that can help in understanding how to view and respond to GuardDuty findings for resources deployed in your environment.

It is recommended that these tests be deployed in a non-production account to ensure that findings generated by these tests can be clearly identified. Additionally, the permissions to deploy these tests are quite broad and using a non-production account helps to ensure that these permissions are contained to an account where the impact of these permissions is reduced.

Deploy Testing Environment

Pre-requisites

• git
• awscli
• Session Manager Plugin installation instructions
• npm
• Docker
• Subscription to Kali Linux Image

Deploy

AWS credentials staged which have enough permissions for deploying all the resources listed in this solution are required to deploy the testing environment. Running cdk deploy from the amazon-guardduty-tester directory will build the tester resources (see below) in the aws cli default account and region unless the account region variables are manually set in the bin/cdk-gd-tester.ts file. Use either approach to define where to deploy the tester.

• git clone https://github.com/awslabs/amazon-guardduty-tester && cd amazon-guardduty-tester
• npm install
• cdk bootstrap #if region not bootstrapped previously
• cdk deploy

Run Tests

Start Session with Test Driver

After the deployment of resources is complete save the region to which you deployed as variables in your terminal:

$ REGION=<region-here>

The tester is only accessible through AWS System Manager (SSM) an operations hub for AWS applications and resources, providing a secure end-to-end management solution. To start an interactive shell on the tester host instance, query the instance id of the host and set it as the 'target' of the session and set the entrance path and command.

Run the following command to begin your session with the tester:

aws ssm start-session \
  --region $REGION \
  --document-name AWS-StartInteractiveCommand \
  --parameters command="cd /home/ssm-user/py_tester && bash -l" \
  --target $(aws ec2 describe-instances \
    --region $REGION \
    --filters "Name=tag:Name,Values=Driver-GuardDutyTester" \
    --query "Reservations[].Instances[?State.Name=='running'].InstanceId" \
    --output text)

Generate Findings

The tester is a python based program that dynamically builds a bash script to generate findings based on user input. You have many options to generate findings based on resource, tactic, GuardDuty feature, log source, and even as granular as one or more specific finding type. python3 guardduty_tester.py --help output gives usage.

EXAMPLES:
  python3 guardduty_tester.py
  python3 guardduty_tester.py --all
  python3 guardduty_tester.py --s3
  python3 guardduty_tester.py --tactics discovery
  python3 guardduty_tester.py --ec2 --eks --tactics backdoor policy execution
  python3 guardduty_tester.py --eks --runtime only
  python3 guardduty_tester.py --ec2 --runtime only --tactics impact
  python3 guardduty_tester.py --log-source dns vpc-flowlogs
  python3 guardduty_tester.py --finding 'CryptoCurrency:EC2/BitcoinTool.B!DNS'

Important Callout

GuardDuty has many features that can be enabled/disabled on an account level such as EKS/ECS/EC2 Runtime Monitoring, Lambda protection, etc. The tester will check these and other account level settings required for the tests requested by the given parameters. Before any account level change is made, the tester will requets user permission and after the tests are completed, the account will be restored to its original state. It is important to note that any changes to GuardDuty protections may begin the 30 day free trial.

Cleanup Test Resources

When finished testing, run cdk destroy or delete the CloudFormation stack on the console in order to delete the resources created by the above deployment steps

Troubleshooting

Common issues:

• Cloud assembly schema version mismatch -> update the AWS CDK CLI to a version. For more info see https://docs.aws.amazon.com/cdk/v2/guide/versioning.html#cdk_toolkit_versioning
• Docker permission denied -> Add the current user to the docker group to be able to run in rootless mode
• Deployment can fails due to Availability Zone incompatibility, if you encounter this error see this post from knowledge AWS share, and either choose a new region or hardcode the region/AZ you wish to deploy in. For region edit the bin/cdk-gd-tester.ts file to reflect your desired region and for AZ edit the lib/common/network/vpc.ts file and replace maxAzs: 2, with availabilityZones: ['<Your-AZ-Here>', '<Your-Other-AZ>' ... ],

Findings Tester Can Generate

Runtime findings are applicable to EC2, ECS, and EKS workloads provided the GuardDuty security agent is installed and operating properly. However some container findings such as PrivilegeEscalation:Runtime/RuncContainerEscape are for containers only and as such are only ECS and EKS applicable. Malware findings are also expected to be generated (depending on tests run), but no manual scanning capabilities have been included in the tester at this time because such scans are not free tier eligible.

- Backdoor:EC2/C&CActivity.B!DNS
- Backdoor:EC2/DenialOfService.DNS
- Backdoor:EC2/DenialOfService.UDP
- Backdoor:Runtime/C&CActivity.B!DNS
- CryptoCurrency:EC2/BitcoinTool.B!DNS
- CryptoCurrency:Runtime/BitcoinTool.B!DNS
- DefenseEvasion:Runtime/ProcessInjection.Ptrace
- DefenseEvasion:Runtime/ProcessInjection.VirtualMemoryWrite
- Discovery:Kubernetes/MaliciousIPCaller.Custom
- Discovery:Kubernetes/SuccessfulAnonymousAccess
- Discovery:Kubernetes/TorIPCaller
- Discovery:S3/MaliciousIPCaller.Custom
- Discovery:S3/TorIPCaller
- Execution:Kubernetes/ExecInKubeSystemPod
- Execution:Runtime/ReverseShell
- Impact:EC2/AbusedDomainRequest.Reputation
- Impact:EC2/BitcoinDomainRequest.Reputation
- Impact:EC2/MaliciousDomainRequest.Reputation
- Impact:EC2/SuspiciousDomainRequest.Reputation
- Impact:Kubernetes/MaliciousIPCaller.Custom
- Impact:Runtime/AbusedDomainRequest.Reputation
- Impact:Runtime/BitcoinDomainRequest.Reputation
- Impact:Runtime/MaliciousDomainRequest.Reputation
- Impact:Runtime/SuspiciousDomainRequest.Reputation
- PenTest:IAMUser/KaliLinux
- PenTest:S3/KaliLinux
- Persistence:Kubernetes/ContainerWithSensitiveMount
- Policy:Kubernetes/AdminAccessToDefaultServiceAccount
- Policy:Kubernetes/AnonymousAccessGranted
- Policy:S3/AccountBlockPublicAccessDisabled
- Policy:S3/BucketAnonymousAccessGranted
- Policy:S3/BucketBlockPublicAccessDisabled
- Policy:S3/BucketPublicAccessGranted
- PrivilegeEscalation:Kubernetes/PrivilegedContainer
- PrivilegeEscalation:Runtime/ContainerMountsHostDirectory
- PrivilegeEscalation:Runtime/DockerSocketAccessed
- Recon:EC2/Portscan
- Recon:IAMUser/MaliciousIPCaller.Custom
- Recon:IAMUser/TorIPCaller
- Stealth:IAMUser/CloudTrailLoggingDisabled
- Stealth:IAMUser/PasswordPolicyChange
- Stealth:S3/ServerAccessLoggingDisabled
- Trojan:EC2/BlackholeTraffic!DNS
- Trojan:EC2/DGADomainRequest.C!DNS
- Trojan:EC2/DNSDataExfiltration
- Trojan:EC2/DriveBySourceTraffic!DNS
- Trojan:EC2/DropPoint!DNS
- Trojan:EC2/PhishingDomainRequest!DNS
- Trojan:Runtime/BlackholeTraffic!DNS
- Trojan:Runtime/DGADomainRequest.C!DNS
- Trojan:Runtime/DriveBySourceTraffic!DNS
- Trojan:Runtime/DropPoint!DNS
- Trojan:Runtime/PhishingDomainRequest!DNS
- UnauthorizedAccess:EC2/MaliciousIPCaller.Custom
- UnauthorizedAccess:EC2/RDPBruteForce
- UnauthorizedAccess:EC2/SSHBruteForce
- UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS
- UnauthorizedAccess:IAMUser/MaliciousIPCaller.Custom
- UnauthorizedAccess:IAMUser/TorIPCaller
- UnauthorizedAccess:Lambda/MaliciousIPCaller.Custom
- UnauthorizedAccess:S3/MaliciousIPCaller.Custom
- UnauthorizedAccess:S3/TorIPCaller

amazon-guardduty-tester's Issues

CloudFormation template fails by missing parameter in AutoScaling

Executing guardduty-tester.template in CloudFormation fail on BastionAutoScalingGroup with reason:
PropagateAtLaunch not found in properties

According to documentation:
AWS::AutoScaling::AutoScalingGroup TagProperty

PropagateAtLaunch is Required.

And it's missing for the second tag of BastionAutoScalingGroup.

Outdated windows ami ids

The stack creation failed, since CloudFormation was not authorized to use "ami-3204995d" for the windows instance in eu-central-1.

Probably all windows amis are not available anymore in all regions.

Unable to generate Backdoor:EC2/DNSDataExfiltration findings

We ran the tester script, but there was no new Backdoor:EC2/DNSDataExfiltration finding in GuardDuty.
The other findings from the script worked fine.

Deployment via CloudFormation always fails

Hi, have tried multiple accounts and regions, the template always fails to deploy as the CFN stack with some issue related to no healthy host response for ECSAutoScalingGroup - "Failed to receive 1 resource signal(s) for the current batch. Each resource signal timeout is counted as a FAILURE".

Can someone please check if the template now doesn't work anymore and see if its possible to fix?

Add documentation on how to run script on bastion

The documentation is missing the step where the scripts are run from the bastion host. It's kind of implied in the README, but I had to look through the script to figure out that it wasn't proxying through the bastion host.

I recommend adding a step to the README on the steps executed on the bastion host.

Transition from ssh+bastion to SSM?

Is there any appetite to transition away from using SSH to get to the red team box, and instead use SSM to connect?

Unable to generate Recon:EC2/PortProbeUnprotectedPort findings

Hi Team,

I have setup the environment which you suggested in README file and ran the script but unable to generate portprobe alerts.

here is the script output

*****************************************************************************************************
Expected GuardDuty Findings

Test 1: Internal Port Scanning
Expected Finding: EC2 Instance  i-05  is performing outbound port scans against remote host. 172.1
Finding Type: Recon:EC2/Portscan

Test 2: SSH Brute Force with Compromised Keys
Expecting two findings - one for the outbound and one for the inbound detection
Outbound:  i-0  is performing SSH brute force attacks against  172.xxxx
Inbound:  172.xxxxxx is performing SSH brute force attacks against  i-07ad
Finding Type: UnauthorizedAccess:EC2/SSHBruteForce

Test 3: RDP Brute Force with Password List
Expecting two findings - one for the outbound and one for the inbound detection
Outbound:  i-056 is performing RDP brute force attacks against  17xxxxxx
Inbound:  17xxxxxxx  is performing RDP brute force attacks against  i-005c71xxxx
Finding Type : UnauthorizedAccess:EC2/RDPBruteForce

Test 4: Cryptocurrency Activity
Expected Finding: EC2 Instance  i-05615xxx is querying a domain name that is associated with bitcoin activity
Finding Type : CryptoCurrency:EC2/BitcoinTool.B!DNS

Test 5: DNS Exfiltration
Expected Finding: EC2 instance  i-05615089xxx  is attempting to query domain names that resemble exfiltrated data
Finding Type : Backdoor:EC2/DNSDataExfiltration

Test 6: C&C Activity
Expected Finding: EC2 instance  i-05615089=xxxx1  is querying a domain name associated with a known Command & Control server. 
Finding Type : Backdoor:EC2/C&CActivity.B!DNS

[ec2-user@ip-17xxxxx ~]$ 

When I checked the script, I did not see the command to do this.
https://github.com/awslabs/amazon-guardduty-tester/blob/master/guardduty_tester.sh#L20

Please suggest how to generate portprobe alert

Add ability to generate a single finding

I would like the ability to generate one type of finding using the script, ideally passed on the command line.

Modify ProxyCommand to no longer use NetCat for proxied access to tester host

Instructions in README.md require use of NetCat with ProxyCommand ("ProxyCommand ssh bastion nc %h %p") this no longer works on the bastion host and results in an error.

[bash: nc  : command not found
kex_exchange_identification: Connection closed by remote host]

Instead, use the -W switch with OpenSSH ("ProxyCommand ssh -W %h:%p bastion").

For more information: https://unix.stackexchange.com/questions/317491/proxycommand-use-for-multiple-hops-and-prompt-authentication

Some findings haven't appeared for over an hour

Severity	Finding Type	Instance	Last	Count
High	UnauthorizedAccess:EC2/RDPBruteForce	Instance: I-0e074acf904a90a45	an hour ago	1
Low	UnauthorizedAccess:EC2/RDPBruteForce	Instance: i-0a726a2dd140c4458	an hour ago	1
Medium	Recon:EC2/Portscan	Instance: i-0e074acf904a90a45	an hour ago	1
High	UnauthorizedAccess:EC2/SSHBruteForce	Instance: i-0e074acf904a90a45	an hour ago	1
Low	UnauthorizedAccess:EC2/SSHBruteForce	Instance: i-0b95fbcf4a9d4d2a6	an hour ago	1

I was expecting to see these by now:

Test 4: Cryptocurrency Activity
Expected Finding: EC2 Instance  i-0e074acf904a90a45  is querying a domain name that is associated with bitcoin activity
Finding Type : CryptoCurrency:EC2/BitcoinTool.B!DNS

Test 5: DNS Exfiltration
Expected Finding: EC2 instance  i-0e074acf904a90a45  is attempting to query domain names that resemble exfiltrated data
Finding Type : Backdoor:EC2/DNSDataExfiltration

Test 6: C&C Activity
Expected Finding: EC2 instance  i-0e074acf904a90a45  is querying a domain name associated with a known Command & Control server. 
Finding Type : Backdoor:EC2/C&CActivity.B!DNS

I've run Tests 4 through 6 several times, but nothing has shown up.

Also, I uploaded an ip.txt to a bucket with the contents of:

4.2.2.2
8.8.8.8

And attempting to reach them via icmp and several ports to trigger the threat list finding.

Am I missing something?

GovCloud Support

Solution is not currently partition agnostic, assumes aws partition.

guardduty-tester.template fails due to`BastionAutoScalingGroup`

Running the template, I encountered a failure in CloudFormation-Stack because it failed to create BastionAutoScalingGroup. The error was Received 0 SUCCESS signal(s) out of 1. Unable to satisfy 100% MinSuccessfulInstancesPercent requirement.

I tried to build the stack with the following parameters under the region ap-northeast-1:

VPCCIDR:  172.16.0.16/28
RemoteAccessCIDR: 0.0.0.0/0
PublicSubnetCIDR:172.16.0.0/28
PrivateSubnetCIDR: 172.16.0.16/28
AvailabilityZones: ap-northeast-1a

Tester script generates only one GuardDuty finding

I've used the guardduty-tester.template for creating cloud formation stack and enabled guardduty on the same region. When I run $ ./guardduty_tester.sh from tester instance only Recon:EC2/Portscan finding is generated by guarduty. Is there any reason why other findings are not generated?

PS: I don't see any errors when running the script.

Automate guarduty-tester.sh

add to the end of the RedTeam Instance UserData

sleep 300; cd /home/ec2-user/; ./guardduty_tester.sh\n