Detection rules › Panther
AWS EC2 Discovery Commands Executed
Multiple different discovery commands were executed by the same EC2 instance. This could indicate a compromised instance.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Discovery | T1526 Cloud Service Discovery |
Rule body yaml
AnalysisType: scheduled_rule
Filename: ec2_discovery_commands.py
RuleID: "AWS.EC2.DiscoveryCommandsExecuted"
DisplayName: "AWS EC2 Discovery Commands Executed"
Enabled: true
ScheduledQueries:
- AWS EC2 Discovery Commands Executed
Severity: Info
Reports:
MITRE ATT&CK:
- TA0007:T1526 # Discoery: Cloud Service Discovery
Description: Multiple different discovery commands were executed by the same EC2 instance.
This could indicate a compromised instance.
DedupPeriodMinutes: 90
Reference:
https://stratus-red-team.cloud/attack-techniques/AWS/aws.discovery.ec2-enumerate-from-instance/
Runbook: Investigate other activity from the instance. Revoke permissions from the
instance until the credentials have been rotated. Determine who was accessing the
instance and monitor the account for other activity.
Tags:
- AWS
- CloudTrail
- EC2
- Discovery
- Cloud Service Discovery
- Beta
Detection logic
Filter
from panther_aws_helpers import aws_rule_context
from panther_core import PantherEvent
def rule(_):
return True
def title(event: PantherEvent):
account = event.get("recipientAccountId")
instance_id = event.deep_get("userIdentity", "arn").split("/")[-1]
return f"{account}: Multiple Discovery Commands Executed on EC2 Instance '{instance_id}'"
def alert_context(event: PantherEvent):
return aws_rule_context(event)
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field |
|---|
eventName |
eventSource |
awsRegion |
recipientAccountId |
sourceIPAddress |
userAgent |
userIdentity |