detection.wiki

Detection rules › Panther

VPC Endpoint Access Denied

Severity
medium
Log types
AWS.CloudTrail
Tags
AWS, VPC, CloudTrail, Network Boundary Bridging, Defense Evasion, Lateral Movement, Impair Defenses
Reference
https://www.wiz.io/blog/aws-vpc-endpoint-cloudtrail
Source
github.com/panther-labs/panther-analysis

Detects when access is denied due to VPC Endpoint policies, which could indicate attempted unauthorized access to AWS resources.

MITRE ATT&CK coverage

TacticTechniques
Defense ImpairmentT1599 Network Boundary Bridging
DiscoveryT1526 Cloud Service Discovery

Rule body yaml

AnalysisType: rule
Filename: aws_vpce_access_denied.py
RuleID: "AWS.CloudTrail.VPCE.AccessDenied"
DisplayName: "VPC Endpoint Access Denied"
Enabled: true
LogTypes:
  - AWS.CloudTrail
Severity: Medium
Tags:
  - AWS
  - VPC
  - CloudTrail
  - Network Boundary Bridging
  - Defense Evasion
  - Lateral Movement
  - Impair Defenses
Reports:
  MITRE ATT&CK:
    - TA0005:T1599 # Network Boundary Bridging
    - TA0007:T1526 # Cloud Service Discovery
Description: Detects when access is denied due to VPC Endpoint policies, which could indicate attempted unauthorized access to AWS resources.
Runbook: |
  1. Identify the principal (user/role) and source IP that was denied access
  2. Determine if this is expected behavior based on your VPC endpoint policies
  3. Check if there are multiple failed attempts from the same principal/IP
  4. If unexpected, investigate why the principal is attempting to access resources through the VPC endpoint
  5. Consider updating your VPC endpoint policies if necessary
  6. Document findings and take appropriate remediation steps based on investigation
Reference: https://www.wiz.io/blog/aws-vpc-endpoint-cloudtrail
SummaryAttributes:
  - errorCode
  - errorMessage
  - sourceIPAddress
  - eventSource
  - eventName
  - userIdentity.principalId
Tests:
  - Name: VPC Endpoint Access Denied 
    ExpectedResult: true
    Log:
      {
        "eventVersion": "1.08",
        "eventCategory": "NetworkActivity",
        "eventType": "AwsVpceEvent",
        "errorCode": "VpceAccessDenied",
        "errorMessage": "The request was denied due to a VPC endpoint policy",
        "eventTime": "2023-03-01T00:00:00Z",
        "awsRegion": "us-east-1",
        "eventSource": "s3.amazonaws.com",
        "eventName": "GetObject",
        "sourceIPAddress": "10.0.0.1",
        "userIdentity": {
          "type": "AWSAccount",
          "principalId": "AROAEXAMPLE:session-name",
          "accountId": "111111111111"
        },
        "recipientAccountId": "222222222222",
        "requestParameters": {
          "bucketName": "example-bucket",
          "key": "sensitive-file.txt"
        },
        "responseElements": null,
        "vpcEndpointId": "vpce-EXAMPLE08c1b6b9b7",
        "vpcEndpointAccountId": "222222222222"
      }
  - Name: Not VPC Endpoint Event
    ExpectedResult: false
    Log:
      {
        "eventVersion": "1.08",
        "eventCategory": "Management",
        "eventType": "AwsApiCall",
        "errorCode": "AccessDenied",
        "errorMessage": "Access Denied",
        "eventTime": "2023-03-01T00:00:00Z",
        "awsRegion": "us-east-1",
        "eventSource": "s3.amazonaws.com",
        "eventName": "GetObject",
        "sourceIPAddress": "10.0.0.1",
        "userIdentity": {
          "type": "IAMUser",
          "principalId": "AROAEXAMPLE:session-name",
          "accountId": "111111111111"
        },
        "recipientAccountId": "222222222222",
        "requestParameters": {
          "bucketName": "example-bucket",
          "key": "sensitive-file.txt"
        },
        "responseElements": null
      }
  - Name: VPC Endpoint Event Without Error
    ExpectedResult: false
    Log:
      {
        "eventVersion": "1.08",
        "eventCategory": "NetworkActivity",
        "eventType": "AwsVpceEvent",
        "eventTime": "2023-03-01T00:00:00Z",
        "awsRegion": "us-east-1",
        "eventSource": "s3.amazonaws.com",
        "eventName": "GetObject",
        "sourceIPAddress": "10.0.0.1",
        "userIdentity": {
          "type": "IAMUser",
          "principalId": "AROAEXAMPLE:session-name",
          "accountId": "111111111111"
        },
        "recipientAccountId": "222222222222",
        "requestParameters": {
          "bucketName": "example-bucket",
          "key": "sensitive-file.txt"
        },
        "responseElements": null
      }

Detection logic

Condition

not (eventType ne "AwsVpceEvent" or eventCategory ne "NetworkActivity")
errorCode eq "VpceAccessDenied"

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
eventCategoryneNetworkActivity
eventTypeneAwsVpceEvent

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
errorCodeeq
  • VpceAccessDenied

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

Field
eventName
eventSource
awsRegion
recipientAccountId
sourceIPAddress
userAgent
userIdentity
actor_user