AWS command executed on the command line

AnalysisType: rule
Filename: osquery_linux_aws_commands.py
RuleID: "Osquery.Linux.AWSCommandExecuted"
DisplayName: "AWS command executed on the command line"
Enabled: true
LogTypes:
  - Osquery.Differential
Tags:
  - Osquery
  - Linux
  - Execution:User Execution
Reports:
  MITRE ATT&CK:
    - TA0002:T1204
Severity: Medium
Description: An AWS command was executed on a Linux instance
Runbook: See which other commands were executed, and then remove IAM role causing the access
Reference: https://attack.mitre.org/techniques/T1078/
SummaryAttributes:
  - name
  - action
Tests:
  - Name: AWS command executed on MacOS
    ExpectedResult: false
    Log:
      {
        "name": "pack_incident-response_shell_history",
        "action": "added",
        "decorations": { "platform": "darwin" },
        "columns":
          {
            "command": "aws sts get-caller-identity",
            "uid": "1000",
            "directory": "/home/ubuntu",
            "username": "ubuntu",
          },
      }
  - Name: AWS command executed
    ExpectedResult: true
    Log:
      {
        "name": "pack_incident-response_shell_history",
        "action": "added",
        "columns":
          {
            "command": "aws s3 ls",
            "uid": "1000",
            "directory": "/home/ubuntu",
            "username": "ubuntu",
          },
      }
  - Name: Tail command executed
    ExpectedResult: false
    Log:
      {
        "name": "pack_incident-response_shell_history",
        "action": "added",
        "columns":
          {
            "command": "tail -f /var/log/all",
            "uid": "1000",
            "directory": "/home/ubuntu",
            "username": "ubuntu",
          },
      }
  - Name: Command with quote executed
    ExpectedResult: false
    Log:
      {
        "name": "pack_incident-response_shell_history",
        "action": "added",
        "columns":
          {
            "command": "git commit -m 'all done'",
            "uid": "1000",
            "directory": "/home/ubuntu",
            "username": "ubuntu",
          },
      }
  - Name: Invalid command ignored
    ExpectedResult: false
    Log:
      {
        "name": "pack_incident-response_shell_history",
        "action": "added",
        "columns":
          {
            "command": "unopened '",
            "uid": "1000",
            "directory": "/home/ubuntu",
            "username": "ubuntu",
          },
      }