Detection rules › Panther
Query.EC2.CRUD.Activity.Role
This is a threat-hunting query, not an automated detection. It surfaces activity for an analyst to review rather than firing on a match. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.
This query searches for CRUD activity in EC2 by role arn. Activities from a role outside typical deployment processes may warrant investigation.
Rules detecting the same action
Other rules on this platform that filter on the same API call or operation.
Rule body yaml
AnalysisType: scheduled_query
QueryName: "Query.EC2.CRUD.Activity.Role"
Enabled: false
Description: >
This query searches for CRUD activity in EC2 by role arn. Activities from a role outside typical deployment processes may warrant investigation.
Query: |
SELECT
count(*) as num_logs,
recipientAccountId,
userIdentity:arn as arn,
eventName,
eventSource
FROM panther_logs.public.aws_cloudtrail
WHERE
eventSource = 'ec2.amazonaws.com'
AND eventName LIKE '%Image%'
AND eventName NOT LIKE '%Describe%'
AND p_occurs_since('3 day')
GROUP BY recipientAccountId, userIdentity:arn, eventName, eventSource
ORDER BY recipientAccountId, count(*)
Schedule:
RateMinutes: 9999
TimeoutMinutes: 5
Detection logic
Stage 1: source
panther_logs.public.aws_cloudtrail
Stage 2: filter
eventSource eq "ec2.amazonaws.com"
eventName wildcard "*Image*"
eventName not wildcard "*Describe*"
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
eventName | match | Describe |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
eventName | wildcard |
|
eventSource | eq |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
num_logs | count ( * ) |
recipientAccountId | |
arn | userIdentity:arn |
eventName | |
eventSource |