AWS Security Hub - Detect SSM documents public sharing enabled

Back


Id	0aa20f8c-b8e4-4a34-a5b8-8b2d9dd7d1c2
Rulename	AWS Security Hub - Detect SSM documents public sharing enabled
Description	This query detects AWS accounts where public sharing is enabled, using AWS Security Hub control SSM.7 findings. Allowing public sharing of SSM documents can expose automation content and enable unauthorized execution or tampering.
Severity	High
Tactics	Execution
Techniques	T1059
Required data connectors	AWSSecurityHub
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AWS Security Hub/Analytic Rules/SSMDocumentsPublicSharingEnabled.yaml
Version	1.0.0
Arm template	0aa20f8c-b8e4-4a34-a5b8-8b2d9dd7d1c2.json

KQL

AWSSecurityHubFindings
| where RecordState == "ACTIVE" and ComplianceStatus == "FAILED"
| where tostring(AwsSecurityFindingGeneratorId) == "security-control/SSM.7"
      or tostring(ComplianceSecurityControlId) == "SSM.7"
| summarize TimeGenerated = max(TimeGenerated)
    by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription,
       AwsSecurityFindingId, ComplianceSecurityControlId

YAML

customDetails:
  FindingId: AwsSecurityFindingId
  Region: AwsRegion
  ComplianceControlId: ComplianceSecurityControlId
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AWS Security Hub/Analytic Rules/SSMDocumentsPublicSharingEnabled.yaml
query: |
  AWSSecurityHubFindings
  | where RecordState == "ACTIVE" and ComplianceStatus == "FAILED"
  | where tostring(AwsSecurityFindingGeneratorId) == "security-control/SSM.7"
        or tostring(ComplianceSecurityControlId) == "SSM.7"
  | summarize TimeGenerated = max(TimeGenerated)
      by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription,
         AwsSecurityFindingId, ComplianceSecurityControlId  
requiredDataConnectors:
- dataTypes:
  - AWSSecurityHubFindings
  connectorId: AWSSecurityHub
tactics:
- Execution
name: AWS Security Hub - Detect SSM documents public sharing enabled
kind: Scheduled
relevantTechniques:
- T1059
severity: High
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: AwsAccountId
  - identifier: CloudAppAccountId
    columnName: AwsAccountId
  entityType: Account
tags:
- AWS Foundational Security Best Practices v1.0.0
queryFrequency: 1h
description: |
  This query detects AWS accounts where public sharing is enabled, using AWS Security Hub control SSM.7 findings.
  Allowing public sharing of SSM documents can expose automation content and enable unauthorized execution or tampering.  
alertDetailsOverride:
  alertDisplayNameFormat: AWS Account {{AwsAccountId}} SSM documents public sharing enabled
  alertDescriptionFormat: AWS Account {{AwsAccountId}} has SSM documents with public sharing enabled. Disable public sharing setting to prevent unintended exposure of automation documents.
triggerThreshold: 0
triggerOperator: gt
version: 1.0.0
queryPeriod: 1h
id: 0aa20f8c-b8e4-4a34-a5b8-8b2d9dd7d1c2

ARM