Detection rules › Panther
AWS Potentially Stolen Service Role
A role was assumed by an AWS service, followed by a user within 24 hours. This could indicate a stolen or compromised AWS service role.
Rules detecting the same action
Other rules on this platform that filter on the same API call or operation.
- SIGNAL - Role Assumed by AWS Service (Panther)
- SIGNAL - Role Assumed by User (Panther)
Rule body yaml
AnalysisType: scheduled_query
Description: A role was assumed by an AWS service, followed by a user within 24 hours. This could indicate a stolen or compromised AWS service role.
Enabled: false
Query: |
SELECT
requestParameters:roleArn AS role,
ARRAY_AGG(distinct userIdentity:principalId) AS users,
ARRAY_AGG(distinct userIdentity:type) AS types
FROM
panther_logs.public.aws_cloudtrail
WHERE
P_OCCURS_SINCE('1 day')
AND eventName = 'AssumeRole'
AND errorCode IS NULL
GROUP BY role
HAVING
ARRAY_SIZE(types) > 1
AND ARRAY_CONTAINS('AWSService'::VARIANT, types)
LIMIT 100
QueryName: "AWS Potentially Stolen Service Role"
Schedule:
RateMinutes: 1440
TimeoutMinutes: 5
Detection logic
Stage 1: source
panther_logs.public.aws_cloudtrail
Stage 2: filter
eventName eq "AssumeRole"
errorCode is_null
Stage 3: having
aggregate comparison (>); threshold not fully parsed
This rule also runs imperative logic the parser cannot express as a filter; the conditions above are the structured part it could extract.
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
role | requestParameters:roleArn |
users | ARRAY_AGG ( DISTINCT userIdentity:principalId ) |
types | ARRAY_AGG ( DISTINCT userIdentity:type ) |