Detection rules › Panther

Panther rules: decoy

Rule	Severity
Decoy DynamoDB Accessed	`high`
Decoy IAM Assumed	`high`
Decoy S3 Accessed	`high`
Decoy Secret Accessed	`high`
Decoy Systems Manager Parameter Accessed	`high`

Decoy DynamoDB Accessed

Severity: high
Entities: actor_ids, aws_account_ids, aws_arns, ip_addresses, trace_ids, usernames
Log types: AWS.SecurityFindingFormat
Reference: aws.amazon.com
Source: github.com/panther-labs/panther-analysis

Actor accessed Decoy DynamoDB

Detection logic

def rule(event):
    # List of suspicious API events
    # NOTE: There may be more API events that's not listed
    suspicious_api_events = [
        "BatchExecuteStatement",
        "BatchGetItem",
        "BatchWriteItem",
        "DeleteItem",
        "ExecuteStatement",
        "ExecuteTransaction",
        "GetItem",
        "PutItem",
        "Query",
        "Scan",
        "TransactGetItems",
        "TransactWriteItems",
        "UpdateItem",
    ]

    # Return True if the API value is in the list of suspicious API events
    if event["GeneratorId"] == "dynamodb.amazonaws.com":
        # Extract the API value from the event
        api_value = event["Action"]["AwsApiCallAction"]["Api"]

        return api_value in suspicious_api_events
    return False


def title(event):
    # (Optional) Return a string which will be shown as the alert title.
    # If no 'dedup' function is defined, the return value of this method will act as dedup string.

    # NOTE: Not sure if the offending actor Id will always be in the 0th index of Resources
    # It's possible to just return the Title as a whole string
    secret = event["Resources"][0]["Id"]
    return f"Suspicious activity detected accessing private decoy DynamoDB table {secret}"

Rule specification

AnalysisType: rule
Filename: decoy_dynamodb_accessed.py
RuleID: "Decoy.DynamoDB.Accessed"
DisplayName: "Decoy DynamoDB Accessed"
Enabled: false
LogTypes:
    - AWS.SecurityFindingFormat
Severity: High
Description: Actor accessed Decoy DynamoDB
DedupPeriodMinutes: 60
Threshold: 1
Reference: https://aws.amazon.com/blogs/security/how-to-detect-suspicious-activity-in-your-aws-account-by-using-private-decoy-resources/
InlineFilters:
    - All: []

Stages and Predicates

Fires on AWS.SecurityFindingFormat events when all of the conditions below hold.

Condition

GeneratorId is dynamodb.amazonaws.com
Action.AwsApiCallAction.Api is one of BatchExecuteStatement, BatchGetItem, BatchWriteItem, DeleteItem, ExecuteStatement (+8 more values, see Indicators below)

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Action.AwsApiCallAction.Api`	in	`BatchExecuteStatement` `BatchGetItem` `BatchWriteItem` `DeleteItem` `ExecuteStatement` `ExecuteTransaction` `GetItem` `PutItem` `Query` `Scan` `TransactGetItems` `TransactWriteItems` `UpdateItem`	`field:"Action.AwsApiCallAction.Api" kind:in`
`GeneratorId`	eq	`dynamodb.amazonaws.com`	`field:"GeneratorId" kind:eq value:"dynamodb.amazonaws.com"`

Worked example

A sample event from the rule's unit tests that triggers a match.

Sample Test Event

{
  "Action": {
    "ActionType": "AWS_API_CALL",
    "AwsApiCallAction": {
      "Api": "Scan",
      "CallerType": "remoteIp",
      "DomainDetails": {},
      "RemoteIpDetails": {
        "City": {},
        "Country": {},
        "GeoLocation": {},
        "IpAddressV4": "11.111.11.111",
        "Organization": {}
      },
      "ServiceName": "dynamodb.amazonaws.com"
    },
    "DnsRequestAction": {},
    "NetworkConnectionAction": {
      "LocalPortDetails": {},
      "RemotePortDetails": {}
    },
    "PortProbeAction": {}
  },
  "AwsAccountId": "123456789012",
  "CompanyName": "Custom",
  "CreatedAt": "2024-05-24 22:53:24.000000000",
  "Description": "Private decoy DynamoDB table arn:aws:dynamodb:us-east-1:123456789012:table/Panther-DataTable was accessed by arn:aws:iam::123456789012:user/tester. This DynamoDB table has been provisioned to monitor and generate security events when accessed and can be an indicator of unintended or unauthorized access to your AWS Account.",
  "FindingProviderFields": {
    "Severity": {
      "Label": "HIGH",
      "Normalized": 70
    },
    "Types": [
      "Unusual Behaviors"
    ]
  },
  "GeneratorId": "dynamodb.amazonaws.com",
  "Id": "1abc2de3-69ea-4e15-91c6-27eb4a07bd21",
  "ProcessedAt": "2024-05-24T22:53:41.884Z",
  "ProductArn": "arn:aws:securityhub:us-east-1:123456789012:product/123456789012/default",
  "ProductFields": {
    "Custom/DecoyDetector/apiResult": "SUCCESS",
    "Custom/DecoyDetector/requestID": "ab1cd234-1986-4c45-8546-fdb1776e23b0",
    "Custom/DecoyDetector/userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36",
    "aws/securityhub/CompanyName": "Personal",
    "aws/securityhub/FindingId": "arn:aws:securityhub:us-east-1:123456789012:product/123456789012/default/1abc2de3-69ea-4e15-91c6-27eb4a07bd21",
    "aws/securityhub/ProductName": "Default"
  },
  "ProductName": "DecoyDetector",
  "RecordState": "ACTIVE",
  "Region": "us-east-1",
  "Resources": [
    {
      "Id": "<id>",
      "Partition": "aws",
      "Region": "us-east-1",
      "ResourceRole": "Target",
      "Type": "AwsDynamoDbTable"
    },
    {
      "Details": {
        "AwsIamAccessKey": {
          "AccessKeyId": "ABC9ONWNS3155VIEJC8U",
          "AccountId": "123456789012",
          "PrincipalId": "ABC9ONWNS3155VIEJC8U:john.doe",
          "PrincipalType": "AssumedRole",
          "SessionContext": {
            "Attributes": {
              "CreationDate": "2024-05-24T22:32:38Z",
              "MfaAuthenticated": false
            },
            "SessionIssuer": {
              "AccountId": "123456789012",
              "Arn": "arn:aws:iam::123456789012:user/tester",
              "PrincipalId": "tester",
              "Type": "Role",
              "UserName": "user/tester"
            }
          }
        }
      },
      "Id": "ABC9ONWNS3155VIEJC8U",
      "Partition": "aws",
      "Region": "us-east-1",
      "ResourceRole": "Actor",
      "Type": "AwsIamAccessKey"
    },
    {
      "Id": "arn:aws:iam::123456789012:user/tester",
      "Partition": "aws",
      "Region": "us-east-1",
      "ResourceRole": "Actor",
      "Type": "AwsIamRole"
    }
  ],
  "SchemaVersion": "2018-10-08",
  "Severity": {
    "Label": "HIGH",
    "Normalized": 70
  },
  "Title": "Suspicious activity detected accessing private decoy DynamoDB table arn:aws:dynamodb:us-east-1:123456789012:table/Panther-DataTable",
  "Types": [
    "Unusual Behaviors"
  ],
  "UpdatedAt": "2024-05-24 22:53:24.000000000",
  "Workflow": {
    "Status": "NEW"
  },
  "WorkflowState": "NEW",
  "p_any_actor_ids": [],
  "p_any_aws_account_ids": [],
  "p_any_aws_arns": [],
  "p_any_ip_addresses": [],
  "p_any_trace_ids": [],
  "p_any_usernames": [],
  "p_event_time": "2024-05-24 22:53:24.000000000",
  "p_log_type": "AWS.SecurityFindingFormat",
  "p_parse_time": "2024-05-24 22:55:04.312964001",
  "p_row_id": "8e1c8ebd709fb49e9eb5a1c61ff1a303",
  "p_schema_version": 0,
  "p_source_id": "e29fd64f-53d9-43ab-92ca-575a8af289e6",
  "p_source_label": "AWS Security Hub"
}

Decoy IAM Assumed

Severity: high
Entities: actor_ids, aws_account_ids, aws_arns, trace_ids, usernames
Log types: AWS.SecurityFindingFormat
Reference: aws.amazon.com
Source: github.com/panther-labs/panther-analysis

Actor assumed decoy IAM role

Detection logic

def rule(event):
    # List of suspicious API events
    # NOTE: There may be more API events that's not listed
    suspicious_api_events = ["AssumeRole"]

    # Return True if the API value is in the list of suspicious API events
    if event["GeneratorId"] == "sts.amazonaws.com":
        # Extract the API value from the event
        api_value = event["Action"]["AwsApiCallAction"]["Api"]

        return api_value in suspicious_api_events
    return False


def title(event):
    # (Optional) Return a string which will be shown as the alert title.
    # If no 'dedup' function is defined, the return value of this method will act as dedup string.

    # NOTE: Not sure if the offending actor Id will always be in the 0th index of Resources
    # It's possible to just return the Title as a whole string
    secret = event["Resources"][0]["Id"]
    return f"Suspicious activity detected accessing private decoy IAM role {secret}"

Rule specification

AnalysisType: rule
Filename: decoy_iam_assumed.py
RuleID: "Decoy.IAM.Assumed"
DisplayName: "Decoy IAM Assumed"
Enabled: false
LogTypes:
    - AWS.SecurityFindingFormat
Severity: High
Description: Actor assumed decoy IAM role
DedupPeriodMinutes: 60
Threshold: 1
Reference: https://aws.amazon.com/blogs/security/how-to-detect-suspicious-activity-in-your-aws-account-by-using-private-decoy-resources/
InlineFilters:
    - All: []

Stages and Predicates

Fires on AWS.SecurityFindingFormat events when all of the conditions below hold.

Condition

GeneratorId is sts.amazonaws.com
Action.AwsApiCallAction.Api is one of AssumeRole

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Action.AwsApiCallAction.Api`	in	`AssumeRole`	`field:"Action.AwsApiCallAction.Api" kind:in value:"AssumeRole"`
`GeneratorId`	eq	`sts.amazonaws.com`	`field:"GeneratorId" kind:eq value:"sts.amazonaws.com"`

Worked example

A sample event from the rule's unit tests that triggers a match.

Sample Test Event

{
  "Action": {
    "ActionType": "AWS_API_CALL",
    "AwsApiCallAction": {
      "Api": "AssumeRole",
      "CallerType": "remoteIp",
      "DomainDetails": {},
      "RemoteIpDetails": {
        "City": {},
        "Country": {},
        "GeoLocation": {},
        "IpAddressV4": "11.1.111.11",
        "Organization": {}
      },
      "ServiceName": "sts.amazonaws.com"
    },
    "DnsRequestAction": {},
    "NetworkConnectionAction": {
      "LocalPortDetails": {},
      "RemotePortDetails": {}
    },
    "PortProbeAction": {}
  },
  "AwsAccountId": "123456789012",
  "CompanyName": "Custom",
  "CreatedAt": "2024-05-24 13:17:15.000000000",
  "Description": "Private decoy IAM role arn:aws:iam::123456789012:role/Dummy-Test-InfoRole-ab21cde50f was accessed by arn:aws:iam::123456789012:user/tester. This IAM role has been provisioned to monitor and generate security events when accessed and can be an indicator of unintended or unauthorized access to your AWS Account.",
  "FindingProviderFields": {
    "Severity": {
      "Label": "HIGH",
      "Normalized": 70
    },
    "Types": [
      "Unusual Behaviors"
    ]
  },
  "GeneratorId": "sts.amazonaws.com",
  "Id": "1abc2de3-69ea-4e15-91c6-27eb4a07bd21",
  "ProcessedAt": "2024-05-24T13:17:21.469Z",
  "ProductArn": "arn:aws:securityhub:us-east-1:123456789012:product/123456789012/default",
  "ProductFields": {
    "Custom/DecoyDetector/apiResult": "SUCCESS",
    "Custom/DecoyDetector/requestID": "ab1cd123-1986-4c45-8546-fdb1776e23b0",
    "Custom/DecoyDetector/userAgent": "AWS Signin, aws-internal/3 aws-sdk-java/1.12.720 Linux/5.10.215-181.850.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/17.0.11+10-LTS java/17.0.11 kotlin/1.3.72 vendor/Amazon.com_Inc. cfg/retry-mode/standard cfg/auth-source#unknown",
    "aws/securityhub/CompanyName": "Personal",
    "aws/securityhub/FindingId": "arn:aws:service:region:123456789012:resource/12345ab9-436d-4d59-ac58-ed6b3127e440",
    "aws/securityhub/ProductName": "Default"
  },
  "ProductName": "DecoyDetector",
  "RecordState": "ACTIVE",
  "Region": "us-east-1",
  "Resources": [
    {
      "Id": "arn:aws:iam::123456789012:role/Dummy-Test-InfoRole-ab21cde50f",
      "Partition": "aws",
      "Region": "us-east-1",
      "ResourceRole": "Target",
      "Type": "AwsIamRole"
    },
    {
      "Details": {
        "AwsIamAccessKey": {
          "AccessKeyId": "ABC9ONWNS3155VIEJC8U",
          "AccountId": "123456789012",
          "PrincipalId": "ABCDEFGH0TOGJSGNQKI0:john.doe",
          "PrincipalType": "AssumedRole",
          "SessionContext": {
            "Attributes": {
              "CreationDate": "2024-05-24T22:32:38Z",
              "MfaAuthenticated": false
            },
            "SessionIssuer": {
              "AccountId": "123456789012",
              "Arn": "arn:aws:iam::123456789012:user/tester",
              "PrincipalId": "ABCDEFGH0TOGJSGNQKI0",
              "Type": "Role",
              "UserName": "user_ab21cde50f"
            }
          }
        }
      },
      "Id": "ABC9ONWNS3155VIEJC8U",
      "Partition": "aws",
      "Region": "us-east-1",
      "ResourceRole": "Actor",
      "Type": "AwsIamAccessKey"
    },
    {
      "Id": "arn:aws:iam::123456789012:user/tester",
      "Partition": "aws",
      "Region": "us-east-1",
      "ResourceRole": "Actor",
      "Type": "AwsIamRole"
    }
  ],
  "SchemaVersion": "2018-10-08",
  "Severity": {
    "Label": "HIGH",
    "Normalized": 70
  },
  "Title": "Suspicious activity detected accessing private decoy IAM role arn:aws:iam::123456789012:role/Dummy-Test-InfoRole-ab21cde50f",
  "Types": [
    "Unusual Behaviors"
  ],
  "UpdatedAt": "2024-05-24 13:17:15.000000000",
  "Workflow": {
    "Status": "NEW"
  },
  "WorkflowState": "NEW",
  "p_any_actor_ids": [],
  "p_any_aws_account_ids": [],
  "p_any_aws_arns": [],
  "p_any_trace_ids": [],
  "p_any_usernames": [],
  "p_event_time": "2024-05-24 22:34:07.000000000",
  "p_log_type": "AWS.SecurityFindingFormat",
  "p_parse_time": "2024-05-24 22:35:04.272574202",
  "p_row_id": "zjj8nmnw9f90uulxfa3bmen8rv5stlcx",
  "p_schema_version": 0,
  "p_source_id": "bb4e16c5-43dd-450c-9227-39f0d152659c",
  "p_source_label": "AWS Security Hub"
}

Decoy S3 Accessed

Severity: high
Entities: actor_ids, aws_account_ids, aws_arns, ip_addresses, trace_ids, usernames
Log types: AWS.SecurityFindingFormat
Reference: aws.amazon.com
Source: github.com/panther-labs/panther-analysis

Actor accessed S3 Manager decoy secret

Detection logic

def rule(event):
    # List of suspicious API events
    # NOTE: There may be more API events that's not listed
    suspicious_api_events = [
        "HeadObject",
        "GetObject",
        "GetObjectAcl",
        "GetObjectAttributes",
        "GetObjectLegalHold",
        "GetObjectLockConfiguration",
        "GetObjectRetention",
        "GetObjectTagging",
        "GetObjectTorrent",
        "PutObject",
        "PutObjectAcl",
        "PutObjectLegalHold",
        "PutObjectLockConfiguration",
        "PutObjectRetention",
        "PutObjectTagging",
        "SelectObjectContent",
        "DeleteObject",
        "DeleteObjects",
        "DeleteObjectTagging",
    ]

    # Return True if the API value is in the list of suspicious API events
    if event["GeneratorId"] == "s3.amazonaws.com":
        # Extract the API value from the event
        api_value = event["Action"]["AwsApiCallAction"]["Api"]

        return api_value in suspicious_api_events
    return False


def title(event):
    # (Optional) Return a string which will be shown as the alert title.
    # If no 'dedup' function is defined, the return value of this method will act as dedup string.

    # NOTE: Not sure if the offending actor Id will always be in the 0th index of Resources
    # It's possible to just return the Title as a whole string
    secret = event["Resources"][0]["Id"]
    return f"Suspicious activity detected accessing private decoy S3 bucket {secret}"

Rule specification

AnalysisType: rule
Filename: decoy_s3_accessed.py
RuleID: "Decoy.S3.Accessed"
DisplayName: "Decoy S3 Accessed"
Enabled: false
LogTypes:
    - AWS.SecurityFindingFormat
Severity: High
Description: Actor accessed S3 Manager decoy secret
DedupPeriodMinutes: 60
Threshold: 1
Reference: https://aws.amazon.com/blogs/security/how-to-detect-suspicious-activity-in-your-aws-account-by-using-private-decoy-resources/
InlineFilters:
    - All: []

Stages and Predicates

Fires on AWS.SecurityFindingFormat events when all of the conditions below hold.

Condition

GeneratorId is s3.amazonaws.com
Action.AwsApiCallAction.Api is one of HeadObject, GetObject, GetObjectAcl, GetObjectAttributes, GetObjectLegalHold (+14 more values, see Indicators below)

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Action.AwsApiCallAction.Api`	in	`DeleteObject` `DeleteObjectTagging` `DeleteObjects` `GetObject` `GetObjectAcl` `GetObjectAttributes` `GetObjectLegalHold` `GetObjectLockConfiguration` `GetObjectRetention` `GetObjectTagging` `GetObjectTorrent` `HeadObject` `PutObject` `PutObjectAcl` `PutObjectLegalHold` `PutObjectLockConfiguration` `PutObjectRetention` `PutObjectTagging` `SelectObjectContent`	`field:"Action.AwsApiCallAction.Api" kind:in`
`GeneratorId`	eq	`s3.amazonaws.com`	`field:"GeneratorId" kind:eq value:"s3.amazonaws.com"`

Worked example

A sample event from the rule's unit tests that triggers a match.

Sample Test Event

{
  "Action": {
    "ActionType": "AWS_API_CALL",
    "AwsApiCallAction": {
      "Api": "GetObject",
      "CallerType": "remoteIp",
      "DomainDetails": {},
      "RemoteIpDetails": {
        "City": {},
        "Country": {},
        "GeoLocation": {},
        "IpAddressV4": "111.111.111.111",
        "Organization": {}
      },
      "ServiceName": "s3.amazonaws.com"
    },
    "DnsRequestAction": {},
    "NetworkConnectionAction": {
      "LocalPortDetails": {},
      "RemotePortDetails": {}
    },
    "PortProbeAction": {}
  },
  "AwsAccountId": "123456789012",
  "CompanyName": "Custom",
  "CreatedAt": "2024-05-24 00:26:57.000000000",
  "Description": "Private decoy S3 bucket panther-databucket was accessed by arn:aws:iam::123456789012:user/tester. This S3 bucket has been provisioned to monitor and generate security events when accessed and can be an indicator of unintended or unauthorized access to your AWS Account.",
  "FindingProviderFields": {
    "Severity": {
      "Label": "HIGH",
      "Normalized": 70
    },
    "Types": [
      "Unusual Behaviors"
    ]
  },
  "GeneratorId": "s3.amazonaws.com",
  "Id": "ABC9ONWNS3155VIEJC8U",
  "ProcessedAt": "2024-05-24T00:27:12.237Z",
  "ProductArn": "arn:aws:securityhub:us-east-1:123456789012:product/123456789012/default",
  "ProductFields": {
    "Custom/DecoyDetector/apiResult": "SUCCESS",
    "Custom/DecoyDetector/requestID": "ab1cd234-1986-4c45-8546-fdb1776e23b0",
    "Custom/DecoyDetector/userAgent": "[Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36]",
    "aws/securityhub/CompanyName": "Personal",
    "aws/securityhub/FindingId": "arn:aws:service:region:123456789012:resource/12345ab6-436d-4d59-ac58-ed6b3127e440",
    "aws/securityhub/ProductName": "Default"
  },
  "ProductName": "DecoyDetector",
  "RecordState": "ACTIVE",
  "Region": "us-east-1",
  "Resources": [
    {
      "Id": "arn:aws:s3:::panther-databucket",
      "Partition": "aws",
      "Region": "us-east-1",
      "ResourceRole": "Target",
      "Tags": {
        "aws:cloudformation:logical-id": "DataBucket",
        "aws:cloudformation:stack-id": "arn:aws:cloudformation:us-east-1:123456789012:stack/Panther/a1b2c345-12f6-11ef-8c74-12deb08d9ef1",
        "aws:cloudformation:stack-name": "Panther"
      },
      "Type": "AwsS3Bucket"
    },
    {
      "Id": "arn:aws:s3:::panther-databucket/object",
      "Partition": "aws",
      "Region": "us-east-1",
      "ResourceRole": "Target",
      "Type": "AwsS3Object"
    },
    {
      "Details": {
        "AwsIamAccessKey": {
          "AccessKeyId": "ABCDEFG1HIJ2KLMNOPQR",
          "AccountId": "123456789012",
          "PrincipalId": "ABCDEFG1HIJ2KLMNOPQR:john.doe",
          "PrincipalType": "AssumedRole",
          "SessionContext": {
            "Attributes": {
              "CreationDate": "2024-05-23T20:20:57Z",
              "MfaAuthenticated": false
            },
            "SessionIssuer": {
              "AccountId": "123456789012",
              "Arn": "arn:aws:iam::123456789012:role/tester",
              "PrincipalId": "ABCDEFG1HIJ2KLMNOPQR",
              "Type": "Role",
              "UserName": "tester"
            }
          }
        }
      },
      "Id": "ABCDEFG1HIJ2KLMNOPQR",
      "Partition": "aws",
      "Region": "us-east-1",
      "ResourceRole": "Actor",
      "Type": "AwsIamAccessKey"
    },
    {
      "Id": "ABCDEFG1HIJ2KLMNOPQR",
      "Partition": "aws",
      "Region": "us-east-1",
      "ResourceRole": "Actor",
      "Type": "AwsIamRole"
    }
  ],
  "SchemaVersion": "2018-10-08",
  "Severity": {
    "Label": "HIGH",
    "Normalized": 70
  },
  "Title": "Suspicious activity detected accessing private decoy S3 bucket panther-databucket",
  "Types": [
    "Unusual Behaviors"
  ],
  "UpdatedAt": "2024-05-24 00:26:57.000000000",
  "Workflow": {
    "Status": "NEW"
  },
  "WorkflowState": "NEW",
  "p_any_actor_ids": [],
  "p_any_aws_account_ids": [],
  "p_any_aws_arns": [],
  "p_any_ip_addresses": [],
  "p_any_trace_ids": [],
  "p_any_usernames": [],
  "p_event_time": "2024-05-24 00:26:57.000000000",
  "p_log_type": "AWS.SecurityFindingFormat",
  "p_parse_time": "2024-05-24 00:30:04.569556803",
  "p_row_id": "624c79c882affe88a1dce9c31fb68f0e",
  "p_schema_version": 0,
  "p_source_id": "e29fd64f-53d9-43ab-92ca-575a8af289e6",
  "p_source_label": "AWS Security Hub"
}

Decoy Secret Accessed

Severity: high
Entities: actor_ids, aws_account_ids, aws_arns, trace_ids, usernames
Log types: AWS.SecurityFindingFormat
Reference: aws.amazon.com
Source: github.com/panther-labs/panther-analysis

Actor accessed Secrets Manager decoy secret

Detection logic

def rule(event):
    # List of suspicious API events
    # NOTE: There may be more API events that's not listed
    suspicious_api_events = ["Decrypt", "Encrypt", "GenerateDataKey"]

    # Return True if the API value is in the list of suspicious API events
    if event["GeneratorId"] == "secretsmanager.amazonaws.com":
        # Extract the API value from the event
        api_value = event["Action"]["AwsApiCallAction"]["Api"]

        return api_value in suspicious_api_events
    return False


def title(event):
    # (Optional) Return a string which will be shown as the alert title.
    # If no 'dedup' function is defined, the return value of this method will act as dedup string.

    # NOTE: Not sure if the offending actor Id will always be in the 0th index of Resources
    # It's possible to just return the Title as a whole string
    secret = event["Resources"][0]["Id"]
    return f"Suspicious activity detected accessing private decoy secret {secret}"

Rule specification

AnalysisType: rule
Filename: decoy_secret_accessed.py
RuleID: "Decoy.Secret.Accessed"
DisplayName: "Decoy Secret Accessed"
Enabled: false
LogTypes:
    - AWS.SecurityFindingFormat
Severity: High
Description: Actor accessed Secrets Manager decoy secret
DedupPeriodMinutes: 60
Threshold: 1
Reference: https://aws.amazon.com/blogs/security/how-to-detect-suspicious-activity-in-your-aws-account-by-using-private-decoy-resources/
InlineFilters:
    - All: []

Stages and Predicates

Fires on AWS.SecurityFindingFormat events when all of the conditions below hold.

Condition

GeneratorId is secretsmanager.amazonaws.com
Action.AwsApiCallAction.Api is one of Decrypt, Encrypt, GenerateDataKey

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Action.AwsApiCallAction.Api`	in	`Decrypt` `Encrypt` `GenerateDataKey`	`field:"Action.AwsApiCallAction.Api" kind:in`
`GeneratorId`	eq	`secretsmanager.amazonaws.com`	`field:"GeneratorId" kind:eq value:"secretsmanager.amazonaws.com"`

Worked example

A sample event from the rule's unit tests that triggers a match.

Sample Test Event

{
  "Action": {
    "ActionType": "AWS_API_CALL",
    "AwsApiCallAction": {
      "Api": "Decrypt",
      "CallerType": "remoteIp",
      "DomainDetails": {},
      "ServiceName": "kms.amazonaws.com"
    },
    "DnsRequestAction": {},
    "NetworkConnectionAction": {
      "LocalPortDetails": {},
      "RemotePortDetails": {}
    },
    "PortProbeAction": {}
  },
  "AwsAccountId": "123456789012",
  "CompanyName": "Custom",
  "CreatedAt": "2024-05-23 20:49:02.000000000",
  "Description": "Private decoy secret arn:aws:secretsmanager:us-east-1:123456789012:secret:Dummy-Secret-ab12cde34f was accessed by arn:aws:iam::123456789012:user/tester. This secret has been provisioned to monitor and generate security events when accessed and can be an indicator of unintended or unauthorized access to your AWS Account.",
  "FindingProviderFields": {
    "Severity": {
      "Label": "HIGH",
      "Normalized": 70
    },
    "Types": [
      "Unusual Behaviors"
    ]
  },
  "GeneratorId": "secretsmanager.amazonaws.com",
  "Id": "1abc2de3-69ea-4e15-91c6-27eb4a07bd21",
  "ProcessedAt": "2024-05-23T20:49:08.396Z",
  "ProductArn": "arn:aws:securityhub:us-east-1:123456789012:product/123456789012/default",
  "ProductFields": {
    "Custom/DecoyDetector/apiResult": "SUCCESS",
    "Custom/DecoyDetector/requestID": "ab1cd234-1986-4c45-8546-fdb1776e23b0",
    "Custom/DecoyDetector/userAgent": "secretsmanager.amazonaws.com",
    "aws/securityhub/CompanyName": "Personal",
    "aws/securityhub/FindingId": "arn:aws:securityhub:us-east-1:123456789012:product/123456789012/default/1abc2de3-69ea-4e15-91c6-27eb4a07bd21",
    "aws/securityhub/ProductName": "Default"
  },
  "ProductName": "DecoyDetector",
  "RecordState": "ACTIVE",
  "Region": "us-east-1",
  "Resources": [
    {
      "Id": "arn:aws:secretsmanager:us-east-1:123456789012:secret:Dummy-Secret-ab12cde34f",
      "Partition": "aws",
      "Region": "us-east-1",
      "ResourceRole": "Target",
      "Tags": {
        "aws:cloudformation:logical-id": "DummySecret",
        "aws:cloudformation:stack-id": "arn:aws:cloudformation:us-east-1:123456789012:stack/Panther/ab1cd123-1986-4c45-8546-fdb1776e23b0",
        "aws:cloudformation:stack-name": "Panther"
      },
      "Type": "AwsSecretsManagerSecret"
    },
    {
      "Id": "arn:aws:kms:us-east-1:123456789012:key/1abc2de3-69ea-4e15-91c6-27eb4a07bd21",
      "Partition": "aws",
      "Region": "us-east-1",
      "ResourceRole": "Target",
      "Type": "AwsKmsKey"
    },
    {
      "Details": {
        "AwsIamAccessKey": {
          "AccessKeyId": "ABC12DEFSG3455VIEJC8U",
          "AccountId": "123456789012",
          "PrincipalId": "ABC12DEFSG3455VIEJC8U:john.doe",
          "PrincipalType": "AssumedRole",
          "SessionContext": {
            "Attributes": {
              "CreationDate": "2024-05-23T20:20:57Z",
              "MfaAuthenticated": false
            },
            "SessionIssuer": {
              "AccountId": "123456789012",
              "Arn": "arn:aws:iam::123456789012:user/tester",
              "PrincipalId": "ABC12DEFSG3455VIEJC8U",
              "Type": "Role",
              "UserName": "tester"
            }
          }
        }
      },
      "Id": "ABC12DEFSG3455VIEJC8U",
      "Partition": "aws",
      "Region": "us-east-1",
      "ResourceRole": "Actor",
      "Type": "AwsIamAccessKey"
    },
    {
      "Id": "arn:aws:iam::123456789012:user/tester",
      "Partition": "aws",
      "Region": "us-east-1",
      "ResourceRole": "Actor",
      "Type": "AwsIamRole"
    }
  ],
  "SchemaVersion": "2018-10-08",
  "Severity": {
    "Label": "HIGH",
    "Normalized": 70
  },
  "Title": "Suspicious activity detected accessing private decoy secret arn:aws:secretsmanager:us-east-1:123456789012:secret:Dummy-Secret-ab12cde34f",
  "Types": [
    "Unusual Behaviors"
  ],
  "UpdatedAt": "2024-05-23 20:49:02.000000000",
  "Workflow": {
    "Status": "NEW"
  },
  "WorkflowState": "NEW",
  "p_any_actor_ids": [],
  "p_any_aws_account_ids": [],
  "p_any_aws_arns": [],
  "p_any_trace_ids": [],
  "p_any_usernames": [],
  "p_event_time": "2024-05-23 20:49:02.000000000",
  "p_log_type": "AWS.SecurityFindingFormat",
  "p_parse_time": "2024-05-23 20:55:04.316376687",
  "p_row_id": "d2b6e541507bace8c6c2b6c31fcedc10",
  "p_schema_version": 0,
  "p_source_id": "e29fd64f-53d9-43ab-92ca-575a8af289e6",
  "p_source_label": "AWS Security Hub test events"
}

Decoy Systems Manager Parameter Accessed

Severity: high
Entities: actor_ids, aws_account_ids, aws_arns, trace_ids, usernames
Log types: AWS.SecurityFindingFormat
Reference: aws.amazon.com
Source: github.com/panther-labs/panther-analysis

Actor accessed Decoy Systems Manager parameter

Detection logic

def rule(event):
    # List of suspicious API events
    # NOTE: There may be more API events that's not listed
    suspicious_api_events = ["Decrypt"]

    # Return True if the API value is in the list of suspicious API events
    if event["GeneratorId"] == "ssm.amazonaws.com":
        # Extract the API value from the event
        api_value = event["Action"]["AwsApiCallAction"]["Api"]

        return api_value in suspicious_api_events
    return False


def title(event):
    # (Optional) Return a string which will be shown as the alert title.
    # If no 'dedup' function is defined, the return value of this method will act as dedup string.

    # NOTE: Not sure if the offending actor Id will always be in the 0th index of Resources
    # It's possible to just return the Title as a whole string
    secret = event["Resources"][0]["Id"]
    return f"Suspicious activity detected accessing \
    private decoy Systems Manager parameter {secret}"

Rule specification

AnalysisType: rule
Filename: decoy_systems_manager_parameter_accessed.py
RuleID: "Decoy.Systems.Manager.Parameter.Accessed"
DisplayName: "Decoy Systems Manager Parameter Accessed"
Enabled: false
LogTypes:
    - AWS.SecurityFindingFormat
Severity: High
Description: Actor accessed Decoy Systems Manager parameter
DedupPeriodMinutes: 60
Threshold: 1
Reference: https://aws.amazon.com/blogs/security/how-to-detect-suspicious-activity-in-your-aws-account-by-using-private-decoy-resources/
InlineFilters:
    - All: []

Stages and Predicates

Fires on AWS.SecurityFindingFormat events when all of the conditions below hold.

Condition

GeneratorId is ssm.amazonaws.com
Action.AwsApiCallAction.Api is one of Decrypt

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Action.AwsApiCallAction.Api`	in	`Decrypt`	`field:"Action.AwsApiCallAction.Api" kind:in value:"Decrypt"`
`GeneratorId`	eq	`ssm.amazonaws.com`	`field:"GeneratorId" kind:eq value:"ssm.amazonaws.com"`

Worked example

A sample event from the rule's unit tests that triggers a match.

Sample Test Event

{
  "Action": {
    "ActionType": "AWS_API_CALL",
    "AwsApiCallAction": {
      "Api": "Decrypt",
      "CallerType": "remoteIp",
      "DomainDetails": {},
      "ServiceName": "kms.amazonaws.com"
    },
    "DnsRequestAction": {},
    "NetworkConnectionAction": {
      "LocalPortDetails": {},
      "RemotePortDetails": {}
    },
    "PortProbeAction": {}
  },
  "AwsAccountId": "123456789012",
  "CompanyName": "Custom",
  "CreatedAt": "2024-05-24 22:34:07.000000000",
  "Description": "Private decoy Systems Manager parameter arn:aws:ssm:us-east-1:123456789012:parameter/info-parameter was accessed by arn:aws:iam::123456789012:user/tester. This Systems Manager parameter has been provisioned to monitor and generate security events when accessed and can be an indicator of unintended or unauthorized access to your AWS Account.",
  "FindingProviderFields": {
    "Severity": {
      "Label": "HIGH",
      "Normalized": 70
    },
    "Types": [
      "Unusual Behaviors"
    ]
  },
  "GeneratorId": "ssm.amazonaws.com",
  "Id": "6abc0de0-69ea-4e15-91c6-27eb4a07bd21",
  "ProcessedAt": "2024-05-24T22:34:15.644Z",
  "ProductArn": "arn:aws:securityhub:us-east-1:123456789012:product/123456789012/default",
  "ProductFields": {
    "Custom/DecoyDetector/apiResult": "SUCCESS",
    "Custom/DecoyDetector/requestID": "ab8cd646-1986-4c45-8546-fdb1776e23b0",
    "Custom/DecoyDetector/userAgent": "AWS Internal",
    "aws/securityhub/CompanyName": "Personal",
    "aws/securityhub/FindingId": "arn:aws:service:region:123456789012:resource/12345ab6-436d-4d59-ac58-ed6b3127e440",
    "aws/securityhub/ProductName": "Default"
  },
  "ProductName": "DecoyDetector",
  "RecordState": "ACTIVE",
  "Region": "us-east-1",
  "Resources": [
    {
      "Id": "arn:aws:ssm:us-east-1:123456789012:parameter/info-parameter",
      "Partition": "aws",
      "Region": "us-east-1",
      "ResourceRole": "Target",
      "Type": "Other"
    },
    {
      "Id": "arn:aws:kms:us-east-1:123456789012:key/007ab31c-bf66-2264-a916-49f6d2ebd1db",
      "Partition": "aws",
      "Region": "us-east-1",
      "ResourceRole": "Target",
      "Type": "AwsKmsKey"
    },
    {
      "Details": {
        "AwsIamAccessKey": {
          "AccessKeyId": "ABC9ONWNS3155VIEJC8U",
          "AccountId": "123456789012",
          "PrincipalId": "ABCDEFG0TOGJSGNQKI0:john.doe",
          "PrincipalType": "AssumedRole",
          "SessionContext": {
            "Attributes": {
              "CreationDate": "2024-05-24T22:32:38Z",
              "MfaAuthenticated": false
            },
            "SessionIssuer": {
              "AccountId": "123456789012",
              "Arn": "arn:aws:iam::123456789012:user/tester",
              "PrincipalId": "ABCDEFG0TOGJSGNQKI0",
              "Type": "Role",
              "UserName": "user_ab21cde50f"
            }
          }
        }
      },
      "Id": "ABC9ONWNS3155VIEJC8U",
      "Partition": "aws",
      "Region": "us-east-1",
      "ResourceRole": "Actor",
      "Type": "AwsIamAccessKey"
    },
    {
      "Id": "arn:aws:iam::123456789012:user/tester",
      "Partition": "aws",
      "Region": "us-east-1",
      "ResourceRole": "Actor",
      "Type": "AwsIamRole"
    }
  ],
  "SchemaVersion": "2018-10-08",
  "Severity": {
    "Label": "HIGH",
    "Normalized": 70
  },
  "Title": "Suspicious activity detected accessing private decoy Systems Manager parameter arn:aws:ssm:us-east-1:123456789012:parameter/info-parameter",
  "Types": [
    "Unusual Behaviors"
  ],
  "UpdatedAt": "2024-05-24 22:34:07.000000000",
  "Workflow": {
    "Status": "NEW"
  },
  "WorkflowState": "NEW",
  "p_any_actor_ids": [],
  "p_any_aws_account_ids": [],
  "p_any_aws_arns": [],
  "p_any_trace_ids": [],
  "p_any_usernames": [],
  "p_event_time": "2024-05-24 22:34:07.000000000",
  "p_log_type": "AWS.SecurityFindingFormat",
  "p_parse_time": "2024-05-24 22:35:04.272574202",
  "p_row_id": "zjj8nmnw9f90uulxfa3bmen8rv5stlcx",
  "p_schema_version": 0,
  "p_source_id": "bb4e16c5-43dd-450c-9227-39f0d152659c",
  "p_source_label": "AWS Security Hub"
}