Detection rules › Panther

Panther rules: retrieve

Rule	Severity
SIGNAL - Retrieve SSO access token	`informational`

SIGNAL - Retrieve SSO access token

Severity: informational
Log types: AWS.CloudTrail
Source: github.com/panther-labs/panther-analysis

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `CreateToken`: CreateToken recorded by CloudTrail for AWS IAM Identity Center. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Detection logic

def rule(event):
    return (
        event.get("eventSource") == "sso.amazonaws.com" and event.get("eventName") == "CreateToken"
    )

Rule specification

AnalysisType: rule
Filename: retrieve_sso_access_token.py
RuleID: "Retrieve.SSO.access.token"
DisplayName: "SIGNAL - Retrieve SSO access token"
Enabled: true
CreateAlert: false
LogTypes:
    - AWS.CloudTrail
Severity: Info
DedupPeriodMinutes: 60
Threshold: 1

Stages and Predicates

Fires on AWS.CloudTrail events when all of the conditions below hold.

Condition

eventSource is sso.amazonaws.com
eventName is CreateToken

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`CreateToken`	`field:"aws::eventName" kind:eq value:"CreateToken"`
`eventSource`	eq	`sso.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"sso.amazonaws.com"`

Worked example

A sample event from the rule's unit tests that triggers a match.

Sample Test Event

{
  "eventName": "CreateToken",
  "eventSource": "sso.amazonaws.com",
  "eventVersion": "1.08",
  "recipientAccountId": "<organization master account ID>",
  "requestParameters": {
    "clientId": "...",
    "clientSecret": "HIDDEN_DUE_TO_SECURITY_REASONS",
    "deviceCode": "...",
    "grantType": "urn:ietf:params:oauth:grant-type:device_code"
  },
  "responseElements": {
    "accessToken": "HIDDEN_DUE_TO_SECURITY_REASONS",
    "expiresIn": 28800,
    "idToken": "HIDDEN_DUE_TO_SECURITY_REASONS",
    "refreshToken": "HIDDEN_DUE_TO_SECURITY_REASONS",
    "tokenType": "Bearer"
  },
  "sourceIPAddress": "<Attacker source IP>",
  "userAgent": "<Attacker user agent (here: Boto3/1.17.80 Python/3.9.5 Darwin/20.3.0 Botocore/1.20.80)>",
  "userIdentity": {
    "accountId": "<organization master account ID>",
    "principalId": "<internal victim user id>",
    "type": "Unknown",
    "userName": "<victim display name>"
  }
}