Detection rules › Panther

Panther rules: role

Rule	Severity
SIGNAL - Role Assumed by AWS Service	`informational`
SIGNAL - Role Assumed by User	`informational`

SIGNAL - Role Assumed by AWS Service

Severity: informational
Log types: AWS.CloudTrail
Source: github.com/panther-labs/panther-analysis

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `AssumeRole`: Returns temporary security credentials for an IAM role that the caller is authorized to assume.

Rules detecting the same action

These rules filter on the same operation.

ASL AWS IAM Assume Role Policy Brute Force (Splunk)
AWS Potentially Stolen Service Role (Panther)
AWS Potentially Stolen Service Role (Panther)
SIGNAL - Role Assumed by User (Panther)

Detection logic

def rule(event):
    aws_service = event.deep_get("userIdentity", "type") == "AWSService"
    return all(
        [
            event.get("eventName") == "AssumeRole",
            event.deep_get("requestParameters", "roleArn"),
            aws_service,
        ]
    )

Rule specification

AnalysisType: rule
Filename: role_assumed_by_aws_service.py
RuleID: "Role.Assumed.by.AWS.Service"
DisplayName: "SIGNAL - Role Assumed by AWS Service"
Enabled: false
CreateAlert: false
LogTypes:
    - AWS.CloudTrail
Severity: Info
DedupPeriodMinutes: 60
Threshold: 1

Stages and Predicates

Fires on AWS.CloudTrail events when all of the conditions below hold.

Condition

eventName is AssumeRole
requestParameters.roleArn is present
userIdentity.type is AWSService

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`AssumeRole`	`field:"aws::eventName" kind:eq value:"AssumeRole"`
`requestParameters.roleArn`	is_not_null	(no value, null check)	`field:"requestParameters.roleArn" kind:is_not_null`
`userIdentity.type`	eq	`AWSService`	`field:"aws::userIdentity.type" kind:eq value:"AWSService"`

Worked example

A sample event from the rule's unit tests that triggers a match.

Sample Test Event

{
  "awsRegion": "us-west-2",
  "eventCategory": "Management",
  "eventID": "1f3d7d49-6637-3304-b959-9be15f20215d",
  "eventName": "AssumeRole",
  "eventSource": "sts.amazonaws.com",
  "eventTime": "2024-06-02 20:27:12",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789123",
  "requestID": "a0dda101-6e27-4f88-8250-f3d475f88b56",
  "requestParameters": {
    "roleArn": "arn:aws:iam::123456789123:role/my_role_arn",
    "roleSessionName": "awslambda_55_20240602202712548"
  },
  "resources": [
    {
      "accountId": "123456789123",
      "arn": "arn:aws:iam::123456789123:role/my_role_arn",
      "type": "AWS::IAM::Role"
    }
  ],
  "responseElements": {
    "credentials": {
      "accessKeyId": "REDACTED",
      "expiration": "Jun 2, 2024, 10:37:12 PM",
      "sessionToken": "REDACTED"
    }
  },
  "sharedEventID": "95e84e79-100a-40a6-985e-3c9c4b41f622",
  "sourceIPAddress": "lambda.amazonaws.com",
  "userAgent": "lambda.amazonaws.com",
  "userIdentity": {
    "invokedBy": "lambda.amazonaws.com",
    "type": "AWSService"
  }
}

SIGNAL - Role Assumed by User

Severity: informational
Log types: AWS.CloudTrail
Source: github.com/panther-labs/panther-analysis