Panther rules: ec2

from panther_aws_helpers import aws_rule_context
from panther_core import PantherEvent


def rule(_):
    return True


def title(event: PantherEvent):
    account = event.get("recipientAccountId")
    instance_id = event.deep_get("userIdentity", "arn").split("/")[-1]
    return f"{account}: Multiple Discovery Commands Executed on EC2 Instance '{instance_id}'"


def alert_context(event: PantherEvent):
    return aws_rule_context(event)

AnalysisType: scheduled_rule
Filename: ec2_discovery_commands.py
RuleID: "AWS.EC2.DiscoveryCommandsExecuted"
DisplayName: "AWS EC2 Discovery Commands Executed"
Enabled: true
ScheduledQueries:
  - AWS EC2 Discovery Commands Executed
Severity: Info
Reports:
  MITRE ATT&CK:
    - TA0007:T1526 # Discoery: Cloud Service Discovery
Description: Multiple different discovery commands were executed by the same EC2 instance.
  This could indicate a compromised instance.
DedupPeriodMinutes: 90
Reference: 
  https://stratus-red-team.cloud/attack-techniques/AWS/aws.discovery.ec2-enumerate-from-instance/
Runbook: Investigate other activity from the instance. Revoke permissions from the
  instance until the credentials have been rotated. Determine who was accessing the
  instance and monitor the account for other activity.
Tags:
  - AWS
  - CloudTrail
  - EC2
  - Discovery
  - Cloud Service Discovery
  - Beta

AnalysisType: scheduled_query
QueryName: "AWS EC2 Discovery Commands Executed"
Enabled: false
Description: Multiple different discovery commands were executed by the same EC2 instance.
Tags:
  - AWS
  - CloudTrail
  - EC2
  - Discovery
SnowflakeQuery: |
  select
    *,
    count(distinct eventName) over (partition by userIdentity:arn) nActions
  from panther_logs.public.aws_cloudtrail
  where p_occurs_since(90m)
  and SPLIT_PART(userIdentity:arn, '/', -1) like 'i-%'
  and ARRAY_CONTAINS(eventName, [
      'GetCallerIdentity',
      'ListBuckets',
      'GetAccountSummary',
      'ListRoles',
      'ListUsers',
      'GetAccountAuthorizationDetails',
      'DescribeSnapshots',
      'DescribeTrails',
      'ListDetectors'
  ])
  qualify nActions > 2

DatabricksQuery: |
  SELECT * FROM (
    SELECT
      *,
      count(distinct eventName) over (partition by userIdentity:arn) AS nActions
    FROM panther_logs.aws_cloudtrail
    WHERE p_occurs_since(90m)
      AND ELEMENT_AT(SPLIT(userIdentity:arn, '/'), -1) LIKE 'i-%'
      AND eventName IN (
          'GetCallerIdentity',
          'ListBuckets',
          'GetAccountSummary',
          'ListRoles',
          'ListUsers',
          'GetAccountAuthorizationDetails',
          'DescribeSnapshots',
          'DescribeTrails',
          'ListDetectors'
      )
  ) WHERE nActions > 2
Schedule:
  RateMinutes: 60
  TimeoutMinutes: 1

AnalysisType: scheduled_query
QueryName: "Query.EC2.CRUD.Activity.Role"
Enabled: false
Description: >
  This query searches for CRUD activity in EC2 by role arn. Activities from a role outside typical deployment processes may warrant investigation.
SnowflakeQuery: |
  SELECT
    count(*) as num_logs,
    recipientAccountId,
    userIdentity:arn as arn,
    eventName,
    eventSource
  FROM panther_logs.public.aws_cloudtrail
  WHERE
    eventSource = 'ec2.amazonaws.com'
    AND eventName LIKE '%Image%'
    AND eventName NOT LIKE '%Describe%'
    AND p_occurs_since('3 day')
  GROUP BY recipientAccountId, userIdentity:arn, eventName, eventSource
  ORDER BY recipientAccountId, count(*)

DatabricksQuery: |
  SELECT
    count(*) as num_logs,
    recipientAccountId,
    userIdentity:arn as arn,
    eventName,
    eventSource
  FROM panther_logs.aws_cloudtrail
  WHERE
    eventSource = 'ec2.amazonaws.com'
    AND eventName LIKE '%Image%'
    AND eventName NOT LIKE '%Describe%'
    AND p_occurs_since('3 day')
  GROUP BY recipientAccountId, userIdentity:arn, eventName, eventSource
  ORDER BY recipientAccountId, count(*)
Schedule:
  RateMinutes: 9999
  TimeoutMinutes: 5

AnalysisType: scheduled_query
QueryName: "Query.EC2.CRUD.Activity.Useragent"
Enabled: false
Description: >
  This query searches for CRUD activity in EC2 by userAgent. A low count or previously unseen useragent may indicate that the action was not performed by an automated process.
SnowflakeQuery: |
  SELECT
    count(*) as num_logs,
    recipientAccountId,
    userAgent,
    eventName,
    eventSource
  FROM panther_logs.public.aws_cloudtrail
  WHERE
    eventSource = 'ec2.amazonaws.com'
    AND eventName LIKE '%Image%'
    AND eventName NOT LIKE '%Describe%'
    AND p_occurs_since('3 day')
  GROUP BY recipientAccountId, userAgent, eventName, eventSource
  ORDER BY recipientAccountId, count(*), userAgent

DatabricksQuery: |
  SELECT
    count(*) as num_logs,
    recipientAccountId,
    userAgent,
    eventName,
    eventSource
  FROM panther_logs.aws_cloudtrail
  WHERE
    eventSource = 'ec2.amazonaws.com'
    AND eventName LIKE '%Image%'
    AND eventName NOT LIKE '%Describe%'
    AND p_occurs_since('3 day')
  GROUP BY recipientAccountId, userAgent, eventName, eventSource
  ORDER BY recipientAccountId, count(*), userAgent
Schedule:
  RateMinutes: 1440
  TimeoutMinutes: 20