Sunturai
Back to results
HighElastic detection rulesElastic

AWS Potential Cryptomining via ECS Task Definition Deployment

Identifies a principal that, within a short window, both registers an Amazon ECS task definition using a public / non-ECR container image at a high CPU allocation (8 or 16 vCPU) AND launches ECS workloads (RunTask,…

Description

Identifies a principal that, within a short window, both registers an Amazon ECS task definition using a public / non-ECR container image at a high CPU allocation (8 or 16 vCPU) AND launches ECS workloads (RunTask, StartTask, or CreateService). Registering a public miner image at maximum compute and then launching it is the ECS/Fargate cryptocurrency-mining deployment pattern seen after credential compromise. Requiring both the mining-signature registration and a launch by the same principal confirms an actual deployment rather than a standalone (possibly benign) task-definition registration, which sharply reduces false positives from high-compute workloads that are merely registered.

Detection logic

Its licence does not clear it for publishing here

Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.

Sign in to read itCreate an account

Detection requirements

Platform
ContainersIaaSLinuxmacOSSaaSWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Known benign triggers

  • A principal that legitimately both registers a high-compute public-image task definition and runs ECS workloads in the same window could match (for example, some data-science or batch pipelines). Confirm the image and CPU in "aws.cloudtrail.request_parameters" of the RegisterTaskDefinition event, the launched workload, and whether the principal in "aws.cloudtrail.user_identity.arn" is an expected ECS operator; exclude known principals after validation. The CPU threshold and registry list are tunable in the query.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice