AnalysisType: rule
DedupPeriodMinutes: 60
DisplayName: AWS Cloudtrail Region Enabled
Enabled: true
Filename: aws_cloudtrail_region_enabled.py
RuleID: "AWS.CloudTrail.EnableRegion"
Severity: Medium
LogTypes:
- AWS.CloudTrail
Tags:
- AWS
- CloudTrail
- Region
Reports:
MITRE ATT&CK:
- TA0005:T1535 # Unused/Unsupported Cloud Regions
Description: >
Threat actors who successfully compromise a victim's AWS account, whether through stolen credentials,
exposed access keys, exploited IAM misconfigurations, vulnerabilities in third-party applications,
or the absence of Multi-Factor Authentication (MFA), can exploit unused regions as safe zones
for malicious activities. These regions are often overlooked in monitoring and security setups,
making them an attractive target for attackers to operate undetected.
Runbook: |
Validate whether enabling the new region was authorized.
Revoke user privileges, review the newly enabled region for malicious activity, and disable the region.
Reference: https://permiso.io/blog/how-threat-actors-leverage-unsupported-cloud-regions
Tests:
- Name: EnableRegion
LogType: AWS.CloudTrail
ExpectedResult: true
Log:
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EXAMPLE",
"arn": "arn:aws:iam::123456789012:user/Alice",
"accountId": "123456789012",
"accessKeyId": "EXAMPLEKEY",
"userName": "Alice"
},
"eventTime": "2023-10-01T12:34:56Z",
"eventSource": "cloudtrail.amazonaws.com",
"eventName": "EnableRegion",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "aws-sdk-go/1.15.12 (go1.12.6; linux; amd64)",
"requestParameters": {
"RegionName": "us-west-2"
},
"responseElements": null,
"additionalEventData": {
"SignatureVersion": "SigV4",
"CipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
"bytesTransferredIn": 0,
"bytesTransferredOut": 0
},
"requestID": "EXAMPLE123456789",
"eventID": "EXAMPLE-1234-5678-9012-EXAMPLE",
"readOnly": false,
"resources": [],
"eventType": "AwsApiCall",
"managementEvent": false,
"recipientAccountId": "123456789012",
"sharedEventID": "EXAMPLE-1234-5678-9012-EXAMPLE",
"vpcEndpointId": "vpce-1a2b3c4d"
}
- Name: Other Event
LogType: AWS.CloudTrail
ExpectedResult: false
Log:
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EXAMPLE",
"arn": "arn:aws:iam::123456789012:user/Bob",
"accountId": "123456789012",
"accessKeyId": "EXAMPLEKEY",
"userName": "Bob"
},
"eventTime": "2023-10-01T12:34:56Z",
"eventSource": "s3.amazonaws.com",
"eventName": "ListBucket",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "aws-sdk-go/1.15.12 (go1.12.6; linux; amd64)",
"requestParameters": {
"bucketName": "example-bucket"
},
"responseElements": null,
"additionalEventData": {
"SignatureVersion": "SigV4",
"CipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
"bytesTransferredIn": 0,
"bytesTransferredOut": 0
},
"requestID": "EXAMPLE123456789",
"eventID": "EXAMPLE-1234-5678-9012-EXAMPLE",
"readOnly": true,
"resources": [
{
"type": "AWS::S3::Bucket",
"ARN": "arn:aws:s3:::example-bucket"
}
],
"eventType": "AwsApiCall",
"managementEvent": false,
"recipientAccountId": "123456789012",
"sharedEventID": "EXAMPLE-1234-5678-9012-EXAMPLE",
"vpcEndpointId": "vpce-1a2b3c4d"
}
# ------ paired body: aws_cloudtrail_region_enabled.py ------
from panther_aws_helpers import aws_rule_context
def rule(event):
return event.get("eventName") == "EnableRegion"
def title(event):
return (
f"AWS CloudTrail region [{event.deep_get('requestParameters', 'RegionName')}] "
f"enabled by user [{event.udm('actor_user')}]"
)
def alert_context(event):
return aws_rule_context(event)