detection.wiki

Detection rules › Panther

AWS EC2 Discovery Commands Executed

Tags
AWS, CloudTrail, EC2, Discovery
Source
github.com/panther-labs/panther-analysis

Multiple different discovery commands were executed by the same EC2 instance.

MITRE ATT&CK coverage

TacticTechniques
DiscoveryNo specific technique

Rule body yaml

AnalysisType: scheduled_query
QueryName: "AWS EC2 Discovery Commands Executed"
Enabled: false
Description: Multiple different discovery commands were executed by the same EC2 instance.
Tags:
  - AWS
  - CloudTrail
  - EC2
  - Discovery
Query: |
  select
    *,
    count(distinct eventName) over (partition by userIdentity:arn) nActions
  from panther_logs.public.aws_cloudtrail
  where p_occurs_since(90m)
  and SPLIT_PART(userIdentity:arn, '/', -1) like 'i-%'
  and ARRAY_CONTAINS(eventName, [
      'GetCallerIdentity',
      'ListBuckets',
      'GetAccountSummary',
      'ListRoles',
      'ListUsers',
      'GetAccountAuthorizationDetails',
      'DescribeSnapshots',
      'DescribeTrails',
      'ListDetectors'
  ])
  qualify nActions > 2
Schedule:
  RateMinutes: 60
  TimeoutMinutes: 1

Detection logic

Stage 1: source

panther_logs.public.aws_cloudtrail

Stage 2: filter

The parser cannot express this rule's logic as a field filter; the imperative Python above is the detection.

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

Field
*
count ( DISTINCT eventName ) OVER ( PARTITION BY userIdentity:arn ) nActions