Panther rules: anomalous

AnalysisType: scheduled_query
Description: ARNs with a high Access Denied error rate could indicate an error or compromised credentials attempting to perform reconnaissance.
Enabled: false
SnowflakeQuery: |
  SELECT
    userIdentity:arn as arn,
    count(DISTINCT eventName) as distinctEventNames
  FROM
    panther_logs.public.aws_cloudtrail
  WHERE
    errorCode = 'AccessDenied'
    and p_occurs_since('1 day')
  GROUP BY userIdentity:arn
  HAVING count(DISTINCT eventName) > 10

DatabricksQuery: |
  SELECT
    userIdentity:arn as arn,
    count(DISTINCT eventName) as distinctEventNames
  FROM
    panther_logs.aws_cloudtrail
  WHERE
    errorCode = 'AccessDenied'
    and p_occurs_since('1 day')
  GROUP BY userIdentity:arn
  HAVING count(DISTINCT eventName) > 10
QueryName: "Anomalous AccessDenied Requests"
Schedule:
  RateMinutes: 1440
  TimeoutMinutes: 5

AnalysisType: saved_query
QueryName: "Anomalous VPC Traffic to Destination Port"
Description: Look at which VPC hosts have been sending a lot of traffic over the past hour
Tags:
  - Anomaly Detection
  - Example
  - Statistical Anomaly
Query: |-
    -- pragma: template

    {% import 'anomalies' statistical_anomaly %}

    with subquery as (
        SELECT *
        FROM panther_logs.public.aws_vpcflow
        WHERE
          p_occurs_since('7 day')
          AND dstAddr not like '10.%'
          AND dstPort < 1024
          AND flowDirection = 'egress'
          AND pktDstAwsService is null
    ),
    {{ statistical_anomaly('subquery', 'srcAddr', 'bytes', 'sum', '1', 'hour', 10) }}

AnalysisType: scheduled_query
Description: RoleAssumes with multiple Useragents could indicate compromised credentials.
Enabled: false
SnowflakeQuery: |
  SELECT
    requestParameters:roleArn as roleArn,
    userIdentity:principalId as principalId,
    count(DISTINCT userAgent) as distinctUserAgents
  FROM
    panther_logs.public.aws_cloudtrail
  WHERE
    eventSource = 'sts.amazonaws.com'
    and eventName = 'AssumeRole'
    and p_occurs_since('1 days')
    and userIdentity:principalId != 'null'
    and userAgent != 'AWS Internal'
    and requestParameters:roleArn != 'null'
  GROUP BY requestParameters:roleArn, userIdentity:principalId
  HAVING count(DISTINCT userAgent) > 1
  ORDER BY count(DISTINCT userAgent) DESC

DatabricksQuery: |
  SELECT
    requestParameters:roleArn as roleArn,
    userIdentity:principalId as principalId,
    count(DISTINCT userAgent) as distinctUserAgents
  FROM
    panther_logs.aws_cloudtrail
  WHERE
    eventSource = 'sts.amazonaws.com'
    and eventName = 'AssumeRole'
    and p_occurs_since('1 days')
    and userIdentity:principalId != 'null'
    and userAgent != 'AWS Internal'
    and requestParameters:roleArn != 'null'
  GROUP BY requestParameters:roleArn, userIdentity:principalId
  HAVING count(DISTINCT userAgent) > 1
  ORDER BY count(DISTINCT userAgent) DESC
QueryName: "RoleAssumes by Multiple Useragents"
Schedule:
  RateMinutes: 1440
  TimeoutMinutes: 5

def rule(_):
    return True

AnalysisType: scheduled_rule
Filename: anomalous_vpc_port_activity.py
RuleID: "VPCFlow.Port.Scanning"
DisplayName: "VPC Flow Port Scanning"
Reports:
  MITRE ATT&CK:
    - TA0007:T1046
Tags:
  - Discovery:Network Service Discovery
Description: >
  Searches for potential port scanning activity in VPC Flow logs
Enabled: false
Status: Deprecated
Runbook: >
  Analyze VPC Flow logs of suspicious IPs and see what ports are being accessed. A sequence of ports may be suspicious
ScheduledQueries:
  - VPC Flow Port Scanning
Severity: Medium

AnalysisType: scheduled_query
Description: Instances of a srcAddr communicating with multiple ports on a dstAddr could indicate port scanning activity.
Enabled: false
SnowflakeQuery: |
  SELECT
    srcAddr,
    dstAddr,
    COUNT(DISTINCT dstPort) as distinctDstPorts,
    vpcId,
    region,
    subNetId
  FROM panther_logs.public.aws_vpcflow
  WHERE p_occurs_since('1 hour')
    and srcAddr != 'null'
    and srcPort not in (443, 80, 2049, 123, 445, 53, 853)
    and dstPort not in (443, 80, 2049, 123, 445, 53, 853)
    and flowDirection = 'egress'
  GROUP BY srcAddr, dstAddr, vpcId, region, subNetId
  HAVING COUNT(DISTINCT dstPort) >=  10
  ORDER BY COUNT(DISTINCT dstPort) DESC

DatabricksQuery: |
  SELECT
    srcAddr,
    dstAddr,
    COUNT(DISTINCT dstPort) as distinctDstPorts,
    vpcId,
    region,
    subNetId
  FROM panther_logs.aws_vpcflow
  WHERE p_occurs_since('1 hour')
    and srcAddr != 'null'
    and srcPort not in (443, 80, 2049, 123, 445, 53, 853)
    and dstPort not in (443, 80, 2049, 123, 445, 53, 853)
    and flowDirection = 'egress'
  GROUP BY srcAddr, dstAddr, vpcId, region, subNetId
  HAVING COUNT(DISTINCT dstPort) >=  10
  ORDER BY COUNT(DISTINCT dstPort) DESC
QueryName: "VPC Flow Port Scanning"
Schedule:
  RateMinutes: 60
  TimeoutMinutes: 5