Alert: Behavior:EC2/NetworkPortUnusual use port:80 to AWS S3 Webpage

user_14330609 0
Viewed 268

The other day, I received the following alert in GuardDuty.

Behavior:EC2/NetworkPortUnusual

port:80 Target:3.5.154.156

The EC2 that was the target of the alert was not being used for anything in particular. (However, it had been started up.) There was no communication using port 80 until now. Also, the IPAddress of the Target seems to be AWS S3.

The only recent change is that I recently deleted the EC2 InstanceProfile. Therefore, there is currently no InstanceProfile attached to anything.

Do you know why this EC2 suddenly tried to use port 80 to communicate with the S3 page?

I looked at CloudTrail, etc., and found nothing suspicious. (If there are any other items I should check, please let me know.)

Thankyou.

amazon-web-services amazon-ec2 amazon-s3
1 Answers

We have experienced similar alerts and after tedious debugging we found that SSM agent is responsible for this kind of GuardDuty findings.

SSM Agent communications with AWS managed S3 buckets "In the course of performing various Systems Manager operations, AWS Systems Manager Agent (SSM Agent) accesses a number of Amazon Simple Storage Service (Amazon S3) buckets. These S3 buckets are publicly accessible, and by default, SSM Agent connects to them using HTTP calls."

I suggest to review CloudTrail logs and look for "UpdateInstanceInformation" event (this is how we found it eventually)

user_10850760
Related