Detection rules › Panther

AWS EC2 Discovery Commands Executed

Severity
informational
Tags
AWS, CloudTrail, EC2, Discovery, Cloud Service Discovery, Beta
Reference
https://stratus-red-team.cloud/attack-techniques/AWS/aws.discovery.ec2-enumerate-from-instance/
Source
github.com/panther-labs/panther-analysis

Multiple different discovery commands were executed by the same EC2 instance. This could indicate a compromised instance.

MITRE ATT&CK coverage

TacticTechniques
DiscoveryT1526 Cloud Service Discovery

Rule body yaml

AnalysisType: scheduled_rule
Filename: ec2_discovery_commands.py
RuleID: "AWS.EC2.DiscoveryCommandsExecuted"
DisplayName: "AWS EC2 Discovery Commands Executed"
Enabled: true
ScheduledQueries:
  - AWS EC2 Discovery Commands Executed
Severity: Info
Reports:
  MITRE ATT&CK:
    - TA0007:T1526 # Discoery: Cloud Service Discovery
Description: Multiple different discovery commands were executed by the same EC2 instance.
  This could indicate a compromised instance.
DedupPeriodMinutes: 90
Reference: 
  https://stratus-red-team.cloud/attack-techniques/AWS/aws.discovery.ec2-enumerate-from-instance/
Runbook: Investigate other activity from the instance. Revoke permissions from the
  instance until the credentials have been rotated. Determine who was accessing the
  instance and monitor the account for other activity.
Tags:
  - AWS
  - CloudTrail
  - EC2
  - Discovery
  - Cloud Service Discovery
  - Beta

Detection logic

Filter

from panther_aws_helpers import aws_rule_context
from panther_core import PantherEvent


def rule(_):
    return True


def title(event: PantherEvent):
    account = event.get("recipientAccountId")
    instance_id = event.deep_get("userIdentity", "arn").split("/")[-1]
    return f"{account}: Multiple Discovery Commands Executed on EC2 Instance '{instance_id}'"


def alert_context(event: PantherEvent):
    return aws_rule_context(event)

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

Field
eventName
eventSource
awsRegion
recipientAccountId
sourceIPAddress
userAgent
userIdentity