Detection rules › Panther

Panther rules: cloudtrail

Rule	Severity
AWS CloudTrail 2-minute count
CloudTrail Password Spraying	`medium`
Query.CloudTrail.Password.Spraying

AWS CloudTrail 2-minute count

This is an enrichment or summary query that produces aggregate or lookup data for other rules to consume, not a standalone detection. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.

Source: github.com/panther-labs/panther-analysis

Rule specification

AnalysisType: scheduled_query
Enabled: false
SnowflakeQuery: |-
  SELECT
    count(*) as num_logs, p_log_type
  FROM
    panther_logs.public.aws_cloudtrail
  WHERE
    p_occurs_since('5m')
  GROUP BY p_log_type

DatabricksQuery: |-
  SELECT
    count(*) as num_logs, p_log_type
  FROM
    panther_logs.aws_cloudtrail
  WHERE
    p_occurs_since('5m')
  GROUP BY p_log_type
QueryName: "AWS CloudTrail 2-minute count"
Schedule:
  RateMinutes: 2
  TimeoutMinutes: 1

Stages and Predicates

Stage 1: `source`

Table: panther_logs.public.aws_cloudtrail

Stage 2: `filter`

Grouped by: p_log_type
Window: 5m

Output fields

Fields the rule emits when it matches, drawn from the rule's alert_context.

Field	Source
`num_logs`	`count ( * )`
`p_log_type`

CloudTrail Password Spraying

Status: Deprecated
Severity: medium
Tags: Initial Access:Valid Accounts
Source: github.com/panther-labs/panther-analysis

Detect password spraying account using a scheduled query

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts

Detection logic

def rule(_):
    return True

Rule specification

AnalysisType: scheduled_rule
Filename: cloudtrail_password_spraying.py
RuleID: "CloudTrail.Password.Spraying"
DisplayName: "CloudTrail Password Spraying"
Reports:
  MITRE ATT&CK:
    - TA0001:T1078
Tags:
  - Initial Access:Valid Accounts
Description: >
  Detect password spraying account using a scheduled query
Enabled: false
Status: Deprecated
Runbook: >
  Analyze the IP they came from, and other actions taken before/after. Check if a user from this ip eventually authenticated successfully.
ScheduledQueries:
  - Query.CloudTrail.Password.Spraying
Severity: Medium

Stages and Predicates

Rule logic

This rule alerts on rows returned by its scheduled query Query.CloudTrail.Password.Spraying; its Python module (Detection logic above) shapes the alert rather than filtering.

Response runbook

Analyze the IP they came from, and other actions taken before/after. Check if a user from this ip eventually authenticated successfully.

Worked example

A sample event from the rule's unit tests that triggers a match.

Sample Test Event

{
  "Anything": "any value"
}

Query.CloudTrail.Password.Spraying

Source: github.com/panther-labs/panther-analysis

Detect password spraying in cloudtrail logs

Rule specification

AnalysisType: scheduled_query
QueryName: "Query.CloudTrail.Password.Spraying"
Enabled: false
Description: >
  Detect password spraying in cloudtrail logs
SnowflakeQuery: |
  SELECT
    -- this information will be in the alert events
    awsRegion as region,
    recipientAccountId as accountid,
    COUNT(DISTINCT useridentity:userName) as distinctUserNames,
    COUNT(1) as failures,
    MIN(p_event_time) as first_attempt,
    MAX(p_event_time) as last_attempt
  FROM
    panther_logs.public.aws_cloudtrail
  WHERE
    p_occurs_since(3600)
    AND
    eventtype = 'AwsConsoleSignIn'
    AND
    responseElements:ConsoleLogin = 'Failure'
  GROUP BY
    region, accountid
  HAVING
    distinctUserNames > 5
    AND
    failures > 10

DatabricksQuery: |
  SELECT
    -- this information will be in the alert events
    awsRegion as region,
    recipientAccountId as accountid,
    COUNT(DISTINCT useridentity:userName) as distinctUserNames,
    COUNT(1) as failures,
    MIN(p_event_time) as first_attempt,
    MAX(p_event_time) as last_attempt
  FROM
    panther_logs.aws_cloudtrail
  WHERE
    p_occurs_since(3600)
    AND
    eventtype = 'AwsConsoleSignIn'
    AND
    responseElements:ConsoleLogin = 'Failure'
  GROUP BY
    region, accountid
  HAVING
    distinctUserNames > 5
    AND
    failures > 10
Schedule:
  RateMinutes: 60
  TimeoutMinutes: 1

Stages and Predicates

Stage 1: `source`

Table: panther_logs.public.aws_cloudtrail

Stage 2: `filter`

eventtype is AwsConsoleSignIn
responseElements:ConsoleLogin is Failure

Grouped by: region, accountid
Window: 1h

Stage 3: `having`

distinctUserNames is greater than 5
failures is greater than 10

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`distinctUserNames`	gt	`5`	`field:"distinctUserNames" kind:gt value:"5"`
`failures`	gt	`10`	`field:"failures" kind:gt value:"10"`
`responseElements:ConsoleLogin`	eq	`Failure`	`field:"responseElements:ConsoleLogin" kind:eq value:"Failure"`

Output fields

Fields the rule emits when it matches, drawn from the rule's alert_context.

Field	Source
`region`	`awsRegion`
`accountid`	`recipientAccountId`
`distinctUserNames`	`COUNT ( DISTINCT useridentity:userName )`
`failures`	`COUNT ( 1 )`
`first_attempt`	`MIN ( p_event_time )`
`last_attempt`	`MAX ( p_event_time )`

Panther rules: cloudtrail

AWS CloudTrail 2-minute count

Rule specification

Stages and Predicates

Stage 1: source

Stage 2: filter

Output fields

CloudTrail Password Spraying

MITRE ATT&CK coverage

Detection logic

Rule specification

Stages and Predicates

Rule logic

Response runbook

Worked example

Query.CloudTrail.Password.Spraying

Rule specification

Stages and Predicates

Stage 1: source

Stage 2: filter

Stage 3: having

Indicators

Output fields

Stage 1: `source`

Stage 2: `filter`

Stage 1: `source`

Stage 2: `filter`

Stage 3: `having`