Many Recon Events

Status: test
Severity: high
Time window: 1m
Log source: product aws, service cloudtrail
Author: Zach Mathis (@yamatosecurity)
Source: github.com/Yamato-Security/suzaku-rules

Detects multiple reconnaissance events, which may indicate an attacker attempting to gather information about the target environment. For each user ARN, it will look for three or more different reconnaissance events within a one minute timespan. If you are getting too many false positives, you can lower the timespan or increase the number of events required to trigger an alert.

MITRE ATT&CK coverage

Tactic	Techniques
Reconnaissance	No specific technique

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `GetAccountAuthorizationDetails`: Retrieves information about all IAM users, groups, roles, and policies in the account, including their relationships.
AWS	CloudTrail event `GetCredentialReport`: Retrieves the credential report for the account, listing all IAM users and the status of their credentials.
AWS	CloudTrail event `GetPolicy`: Retrieves metadata about a managed IAM policy, including its ARN, default version, and attachment count.
AWS	CloudTrail event `GetPolicyVersion`: Retrieves the policy document for a specific version of a managed IAM policy.
AWS	CloudTrail event `GetRole`: Retrieves metadata about an IAM role, including its trust policy and attached managed policies.
AWS	CloudTrail event `GetRolePolicy`: Retrieves the inline policy document embedded in an IAM role.
AWS	CloudTrail event `GetUser`: Retrieves metadata about an IAM user, including path, user ID, ARN, and creation date.
AWS	CloudTrail event `GetUserPolicy`: Retrieves the inline policy document embedded in an IAM user.
AWS	CloudTrail event `ListAccessKeys`: Returns metadata about the access keys associated with a specified IAM user, including key IDs, status, and creation dates.
AWS	CloudTrail event `ListAttachedRolePolicies`: Lists all managed policies attached to a specified IAM role.
AWS	CloudTrail event `ListAttachedUserPolicies`: Lists all managed policies attached to a specified IAM user.
AWS	CloudTrail event `ListGroups`: Returns a paginated list of IAM groups in the current AWS account.
AWS	CloudTrail event `ListRoles`: Returns a paginated list of IAM roles in the current AWS account, optionally filtered by path prefix.
AWS	CloudTrail event `ListUserPolicies`: Lists the names of inline policies embedded in a specified IAM user.
AWS	CloudTrail event `ListUsers`: Returns a paginated list of IAM users in the current AWS account, optionally filtered by path prefix.

Rules detecting the same action

These rules filter on the same operation.

AWS Discovery API Calls from VPN ASN for the First Time by Identity (Elastic)
AWS IAM Group Read Only Events (Panther)
Role Enumeration (Sigma)
User Enumeration (Sigma)

Rule body


title: Many Recon Events
id: 08d8b077-cc1c-4b74-8e9c-e07f84b203f0
status: test
description: |
    Detects multiple reconnaissance events, which may indicate an attacker attempting to gather information about the target environment.
    For each user ARN, it will look for three or more different reconnaissance events within a one minute timespan.
    If you are getting too many false positives, you can lower the timespan or increase the number of events required to trigger an alert.
references:
author: Zach Mathis (@yamatosecurity)
date: 2025-08-02
modified: 2025-08-02
tags:
    - attack.reconnaissance
logsource:
    product: aws
    service: cloudtrail
correlation:
    type: value_count
    rules:
        - Recon Event
    group-by:
        - userIdentity.arn
    timespan: 1m
    condition:
        gte: 3
        field: eventName
    generate: false
level: high
---
title: Recon Event
id: 33ecb0d0-389f-4954-ae8e-7b62f9e369b8
status: test
description: Detects reconnaissance activity.
references:
author: Zach Mathis (@yamatosecurity)
date: 2025-08-02
modified: 2025-08-02
tags:
    - attack.reconnaissance
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'iam.amazonaws.com'
    selection_recon:
          eventName:
            - ListUsers
            - ListRoles
            - ListGroups
            - ListAttachedRolePolicies
            - ListAttachedUserPolicies
            - ListUserPolicies
            - ListAccessKeys
            - GetCredentialReport
            - GetAccountAuthorizationDetails
            - GetCallerIdentity
            - GetPolicy
            - GetPolicyVersion
            - GetRole
            - GetRolePolicy
            - GetUser
            - GetUserPolicy
            - DescribeRegions
            - DescribeAvailabilityZones
            - DescribeVpcs
            - DescribeSubnets
            - DescribeSecurityGroups
            - DescribeInstances
            - DescribeVolumes
            - DescribeImages
            - DescribeNetworkInterfaces
            - ListServiceQuotas
            - ListServices
            - ListBuckets
            - GetBucketAcl
            - GetBucketPolicy
            - ListTables
            - DescribeTable
            - ListRepositories
            - DescribeRepositories
            - GetSessionToken
            - LookupEvents
            - DescribeTrails
            - GetTrailStatus
            - ListTrails
            - ListFunctions
            - ListTopics   
            - ListQueues   
            - ListClusters 
            - DescribeCluster
    condition: all of selection*
level: low

Stages and Predicates

Stage 0: `condition`

all of selection*

Stage 1: `selection`

selection:
    eventSource: 'iam.amazonaws.com'

Stage 2: `selection_recon`

selection_recon:
      eventName:
        - ListUsers
        - ListRoles
        - ListGroups
        - ListAttachedRolePolicies
        - ListAttachedUserPolicies
        - ListUserPolicies
        - ListAccessKeys
        - GetCredentialReport
        - GetAccountAuthorizationDetails
        - GetCallerIdentity
        - GetPolicy
        - GetPolicyVersion
        - GetRole
        - GetRolePolicy
        - GetUser
        - GetUserPolicy
        - DescribeRegions
        - DescribeAvailabilityZones
        - DescribeVpcs
        - DescribeSubnets
        - DescribeSecurityGroups
        - DescribeInstances
        - DescribeVolumes
        - DescribeImages
        - DescribeNetworkInterfaces
        - ListServiceQuotas
        - ListServices
        - ListBuckets
        - GetBucketAcl
        - GetBucketPolicy
        - ListTables
        - DescribeTable
        - ListRepositories
        - DescribeRepositories
        - GetSessionToken
        - LookupEvents
        - DescribeTrails
        - GetTrailStatus
        - ListTrails
        - ListFunctions
        - ListTopics
        - ListQueues
        - ListClusters
        - DescribeCluster

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`DescribeAvailabilityZones` `DescribeCluster` `DescribeImages` `DescribeInstances` `DescribeNetworkInterfaces` `DescribeRegions` `DescribeRepositories` `DescribeSecurityGroups` `DescribeSubnets` `DescribeTable` `DescribeTrails` `DescribeVolumes` `DescribeVpcs` `GetAccountAuthorizationDetails` `GetBucketAcl` `GetBucketPolicy` `GetCallerIdentity` `GetCredentialReport` `GetPolicy` `GetPolicyVersion` `GetRole` `GetRolePolicy` `GetSessionToken` `GetTrailStatus` `GetUser` `GetUserPolicy` `ListAccessKeys` `ListAttachedRolePolicies` `ListAttachedUserPolicies` `ListBuckets` `ListClusters` `ListFunctions` `ListGroups` `ListQueues` `ListRepositories` `ListRoles` `ListServiceQuotas` `ListServices` `ListTables` `ListTopics` `ListTrails` `ListUserPolicies` `ListUsers` `LookupEvents`	`field:"aws::eventName" kind:eq`
`eventSource`	eq	`iam.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"iam.amazonaws.com"`