Detection rules › Panther
AWS Authentication from CrowdStrike Unmanaged Device (crowdstrike_fdrevent table)
Detects AWS Authentication events with IP Addresses not found in CrowdStrike's AIP List
Rules detecting the same action
Other rules on this platform that filter on the same API call or operation.
- AWS EC2 Instance Console Login via Assumed Role (Elastic)
- AWS Management Console Brute Force of Root User Identity (Elastic)
- AWS Management Console Root Login (Elastic)
- AWS Sign-In Console Login with Federated User (Elastic)
- AWS STS GetSessionToken by IAM User (Panther)
- AWS STS GetSessionToken Misuse (Sigma)
- AWS STS GetSessionToken Usage (Elastic)
- Console Login With MFA (Sigma)
Rule body yaml
# This file is the part of the Crowdstrike FDREvent migration, and it's the equivalent of
# https://github.com/panther-labs/panther-analysis/blob/b61db1ecf3967c5f6a44c1782f8891fd5f54384d/queries/aws_queries/AWS_Authentication_from_CrowdStrike_Unmanaged_Device.yml
#
AnalysisType: scheduled_query
Description: Detects AWS Authentication events with IP Addresses not found in CrowdStrike's AIP List
Enabled: false
Query: |
SELECT *
FROM panther_logs.public.aws_cloudtrail
WHERE p_occurs_since('1 days')
AND eventName IN ('ConsoleLogin', 'SignIn', 'GetSessionToken')
AND eventSource IN ('sts.amazonaws.com', 'signin.amazonaws.com')
AND sourceIPAddress NOT IN
(
SELECT DISTINCT aip
FROM panther_logs.public.crowdstrike_fdrevent
WHERE p_occurs_since('3 days') AND panther_logs.public.crowdstrike_fdrevent.fdr_event_type = 'aid_master'
)
QueryName: "AWS Authentication from CrowdStrike Unmanaged Device (crowdstrike_fdrevent table)"
Schedule:
RateMinutes: 1440
TimeoutMinutes: 3
Tags:
- Multi-Table Query
Detection logic
Stage 1: source
panther_logs.public.aws_cloudtrail
Stage 2: filter
eventName in ["ConsoleLogin", "SignIn", "GetSessionToken"]
eventSource in ["sts.amazonaws.com", "signin.amazonaws.com"]
sourceIPAddress not in (subquery on panther_logs.public.crowdstrike_fdrevent)
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
eventName | in |
|
eventSource | in |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field |
|---|
* |