Detection rules › Panther

Panther rules: signin

Rule	Severity
SIGNAL - Sign-in with AWS CLI prompt	`informational`

SIGNAL - Sign-in with AWS CLI prompt

Severity: informational
Log types: AWS.CloudTrail
Source: github.com/panther-labs/panther-analysis

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `ListApplications`: Lists all applications associated with the instance of IAM Identity Center.

Detection logic

def rule(event):
    return (
        event.get("eventSource") == "sso.amazonaws.com"
        and event.get("eventName") == "ListApplications"
    )

Rule specification

AnalysisType: rule
Filename: signin_with_aws_cli_prompt.py
RuleID: "Sign-in.with.AWS.CLI.prompt"
DisplayName: "SIGNAL - Sign-in with AWS CLI prompt"
Enabled: true
CreateAlert: false
LogTypes:
    - AWS.CloudTrail
Severity: Info
DedupPeriodMinutes: 60
Threshold: 1

Stages and Predicates

Fires on AWS.CloudTrail events when all of the conditions below hold.

Condition

eventSource is sso.amazonaws.com
eventName is ListApplications

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`ListApplications`	`field:"aws::eventName" kind:eq value:"ListApplications"`
`eventSource`	eq	`sso.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"sso.amazonaws.com"`

Worked example

A sample event from the rule's unit tests that triggers a match.

Sample Test Event

{
  "eventName": "ListApplications",
  "eventSource": "sso.amazonaws.com",
  "eventTime": "...",
  "eventVersion": "1.08",
  "sourceIPAddress": "<Victim source IP>",
  "userAgent": "<Victim browser user agent>",
  "userIdentity": {
    "accountId": "<organization master account ID>",
    "principalId": "<internal victim user id>",
    "type": "Unknown",
    "userName": "<victim display name>"
  }
}