Generating AWS Threats in Red Canary

Issue

This article includes step-by-step guidance on how to generate test threats in Red Canary using rccar for Amazon Web Services integrations.

Environment

Red Canary

   AWS Integrations

Cause

Red Canary uses a similar test to the European Institute for Computer Anti-Virus Research (EICAR) with Cloudtrail to provide data flow validation testing for Amazon Web Services.

You may need to test data flow by creating or updating a resource, so we have built tests for both scenarios.

Resolution

Using AWS CLI

1. Log in to AWS via the AWS CLI tool
2. Create the rccar security group using the following command

   • aws ec2 create-security-group --group-name rccar-27b29a4f6dd69ce1ca944d5c961daed8db30bb439b210a560a43c83a8cace217-rccar --description 'Red Canary Test'

3. Next, authorize incoming ICMP traffic with the following command

   • aws ec2 authorize-security-group-ingress --group-name rccar-27b29a4f6dd69ce1ca944d5c961daed8db30bb439b210a560a43c83a8cace217-rccar --protocol icmp --port -1

4. After testing, clean up the test resources by deleting the security group with the following command

   • aws ec2 delete-security-group --group-name rccar-27b29a4f6dd69ce1ca944d5c961daed8db30bb439b210a560a43c83a8cace217-rccar

   • Note: If this command fails, the security group likely does not exist, and no cleanup is necessary

Using the AWS Web Console

1. Log in to the AWS web console
2. Navigate to the EC2 Dashboard
   • 
3. From the navigation menu, Click on the Network & Security dropdown and select Security Groups
   • 
4. Click Create security groups
   • 
5. For the security group name, enter the following
   • rccar-27b29a4f6dd69ce1ca944d5c961daed8db30bb439b210a560a43c83a8cace217-rccar
   • 
6. Click Create security group
7. After testing, find and select the rccar security group by clicking on its Security Group ID
8. Click the Actions dropdown
9. Select Delete security groups
   • 

Validating Test in AWS CloudTrail

This process allows you to confirm that the actions you performed have been logged in CloudTrail, ensuring that your test events are recorded and can be analyzed for verification.

Note: CloudTrail event history is limited to the past 90 days of events.

1. Navigate into CloudTrail
   • 
2. Select Event History from the navigation tree
   • 
3. Filter for Event Name and CreateSecurityGroup and see if our test is picked up
   • 
   • Note: Ensure the CreateSecurityGroup event type occurred seen in the history shows up within 5 minutes of your testing
4. Filter for Event Name and DeleteSecurityGroup
   • 
   • Note: Ensure the DeleteSecurityGroup event type occurred seen in the history shows up within 5 minutes of your testing
5. Filter for Event Name and AuthorizeSecurityGroupIngress
   • 
   • Note: Ensure the AuthorizeSecurityGroupIngress event type occurred seen in the history shows up within 5 minutes of your testing

Additional Notes

• For the purposes of rccar testing, security group updates can only be tested via AWS CLI