A CloudTrail Was Created or Updated

AnalysisType: rule
Filename: aws_cloudtrail_created.py
RuleID: "AWS.CloudTrail.Created"
DisplayName: "A CloudTrail Was Created or Updated"
Enabled: true
LogTypes:
  - AWS.CloudTrail
Tags:
  - AWS
  - Security Control
  - Discovery:Cloud Service Dashboard
Reports:
  CIS:
    - 3.5
  MITRE ATT&CK:
    - TA0007:T1538

  Stratus Red Team:
    - aws.defense-evasion.cloudtrail-stop
Severity: Info
Description: >
  A CloudTrail Trail was created, updated, or enabled.
Runbook: https://docs.runpanther.io/alert-runbooks/built-in-rules/aws-cloudtrail-modified
Reference: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-and-update-a-trail.html
SummaryAttributes:
  - eventName
  - userAgent
  - sourceIpAddress
  - recipientAccountId
  - p_any_aws_arns
Tests:
  - Name: CloudTrail Was Created
    ExpectedResult: true
    Log:
      {
        "eventVersion": "1.05",
        "userIdentity":
          {
            "type": "AssumedRole",
            "principalId": "tester",
            "arn": "arn:aws:sts::123456789012:assumed-role/tester",
            "accountId": "123456789012",
            "accessKeyId": "1",
            "sessionContext":
              {
                "sessionIssuer":
                  {
                    "type": "Role",
                    "principalId": "1111",
                    "arn": "arn:aws:iam::123456789012:role/tester",
                    "accountId": "123456789012",
                    "userName": "Tester",
                  },
                "webIdFederationData": {},
                "attributes":
                  {
                    "mfaAuthenticated": "true",
                    "creationDate": "2019-01-01T00:00:00Z",
                  },
              },
          },
        "eventTime": "2019-01-01T00:00:00Z",
        "eventSource": "cloudtrail.amazonaws.com",
        "eventName": "CreateTrail",
        "awsRegion": "us-west-2",
        "sourceIPAddress": "111.111.111.111",
        "userAgent": "console.amazonaws.com",
        "requestParameters":
          {
            "name": "arn:aws:cloudtrail:us-west-2:123456789012:trail/example-trail",
          },
        "responseElements": null,
        "requestID": "1",
        "eventID": "1",
        "readOnly": false,
        "eventType": "AwsApiCall",
        "recipientAccountId": "123456789012",
      }
  - Name: KMS Decrypt Event
    ExpectedResult: false
    Log:
      {
        "eventVersion": "1.05",
        "userIdentity":
          {
            "type": "AssumedRole",
            "principalId": "111:panther-snapshot-scheduler",
            "arn": "arn:aws:sts::123456789012:assumed-role/tester",
            "accountId": "123456789012",
            "accessKeyId": "1",
            "sessionContext":
              {
                "attributes":
                  {
                    "mfaAuthenticated": "false",
                    "creationDate": "2019-01-01T00:00:00Z",
                  },
                "sessionIssuer":
                  {
                    "type": "Role",
                    "principalId": "1111",
                    "arn": "arn:aws:iam::123456789012:role/tester",
                    "accountId": "123456789012",
                    "userName": "tester",
                  },
              },
          },
        "eventTime": "2019-01-01T00:00:00Z",
        "eventSource": "kms.amazonaws.com",
        "eventName": "Decrypt",
        "awsRegion": "us-west-2",
        "sourceIPAddress": "111.111.111.111",
        "userAgent": "Mozilla",
        "requestParameters":
          {
            "encryptionContext":
              {
                "aws:lambda:FunctionArn": "arn:aws:lambda:us-west-2:123456789012:function:test-function",
              },
          },
        "responseElements": null,
        "requestID": "1",
        "eventID": "1",
        "readOnly": true,
        "resources":
          [
            {
              "ARN": "arn:aws:kms:us-west-2:123456789012:key/1",
              "accountId": "123456789012",
              "type": "AWS::KMS::Key",
            },
          ],
        "eventType": "AwsApiCall",
        "recipientAccountId": "123456789012",
      }
  - Name: Error Creating CloudTrail
    ExpectedResult: false
    Log:
      {
        "eventVersion": "1.05",
        "errorCode": "CloudTrailInvalidClientTokenIdException",
        "userIdentity":
          {
            "type": "AssumedRole",
            "principalId": "tester",
            "arn": "arn:aws:sts::123456789012:assumed-role/tester",
            "accountId": "123456789012",
            "accessKeyId": "1",
            "sessionContext":
              {
                "sessionIssuer":
                  {
                    "type": "Role",
                    "principalId": "1111",
                    "arn": "arn:aws:iam::123456789012:role/tester",
                    "accountId": "123456789012",
                    "userName": "Tester",
                  },
                "webIdFederationData": {},
                "attributes":
                  {
                    "mfaAuthenticated": "true",
                    "creationDate": "2019-01-01T00:00:00Z",
                  },
              },
          },
        "eventTime": "2019-01-01T00:00:00Z",
        "eventSource": "cloudtrail.amazonaws.com",
        "eventName": "CreateTrail",
        "awsRegion": "us-west-2",
        "sourceIPAddress": "111.111.111.111",
        "userAgent": "console.amazonaws.com",
        "requestParameters":
          {
            "name": "arn:aws:cloudtrail:us-west-2:123456789012:trail/example-trail",
          },
        "responseElements": null,
        "requestID": "1",
        "eventID": "1",
        "readOnly": false,
        "eventType": "AwsApiCall",
        "recipientAccountId": "123456789012",
      }


# ------ paired body: aws_cloudtrail_created.py ------

from panther_aws_helpers import aws_cloudtrail_success, aws_rule_context

# API calls that are indicative of CloudTrail changes
CLOUDTRAIL_CREATE_UPDATE = {
    "CreateTrail",
    "UpdateTrail",
    "StartLogging",
}


def rule(event):
    return aws_cloudtrail_success(event) and event.get("eventName") in CLOUDTRAIL_CREATE_UPDATE


def title(event):
    return f"CloudTrail [{event.deep_get('requestParameters', 'name')}] was created/updated"


def alert_context(event):
    return aws_rule_context(event)