IAM Change

Description

A change occurred in the IAM configuration. This could be a resource being created, deleted, or modified. This is a high level view of changes, helfpul to indicate how dynamic a certain IAM environment is.

Query · python

from panther_aws_helpers import aws_cloudtrail_success, aws_rule_context

IAM_CHANGE_ACTIONS = [
    "Add",
    "Attach",
    "Change",
    "Create",
    "Deactivate",
    "Delete",
    "Detach",
    "Enable",
    "Put",
    "Remove",
    "Set",
    "Update",
    "Upload",
]


def rule(event):
    # Only check IAM events, as the next check is relatively computationally
    # expensive and can often be skipped
    if not aws_cloudtrail_success(event) or event.get("eventSource") != "iam.amazonaws.com":
        return False

    return any((event.get("eventName", "").startswith(action) for action in IAM_CHANGE_ACTIONS))


def alert_context(event):
    return aws_rule_context(event)

Analyst notes

Ensure this was an approved IAM configuration change.

Raw source IAM Change · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Filename: aws_iam_anything_changed.py
RuleID: "AWS.CloudTrail.IAMAnythingChanged"
DisplayName: "IAM Change"
Enabled: true
LogTypes:
  - AWS.CloudTrail
Tags:
  - AWS
  - Identity and Access Management
Reports:
  Stratus Red Team:
    - aws.persistence.iam-backdoor-role
    - aws.persistence.iam-backdoor-user
    - aws.persistence.iam-create-admin-user
    - aws.persistence.iam-create-backdoor-role
    - aws.persistence.iam-create-user-login-profile
    - aws.privilege-escalation.iam-update-user-login-profile
Severity: Info
DedupPeriodMinutes: 720 # 12 hours
Description: >
  A change occurred in the IAM configuration. This could be a resource being created, deleted, or modified. This is a high level view of changes, helfpul to indicate how dynamic a certain IAM environment is.
Runbook: >
  Ensure this was an approved IAM configuration change.
Reference: https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html
SummaryAttributes:
  - eventName
  - userAgent
  - sourceIpAddress
  - recipientAccountId
  - p_any_aws_arns
Tests:
  - Name: IAM Change
    ExpectedResult: true
    Log:
      {
        "awsRegion": "us-east-1",
        "eventID": "1111",
        "eventName": "AttachRolePolicy",
        "eventSource": "iam.amazonaws.com",
        "eventTime": "2019-01-01T00:00:00Z",
        "eventType": "AwsApiCall",
        "eventVersion": "1.05",
        "recipientAccountId": "123456789012",
        "requestID": "1111",
        "requestParameters":
          {
            "policyArn": "arn:aws:iam::aws:policy/example-policy",
            "roleName": "LambdaFunctionRole-1111",
          },
        "responseElements": null,
        "sourceIPAddress": "111.111.111.111",
        "userAgent": "cloudformation.amazonaws.com",
        "userIdentity":
          {
            "accesKeyId": "1111",
            "accessKeyId": "1111",
            "accountId": "123456789012",
            "arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-user",
            "invokedBy": "cloudformation.amazonaws.com",
            "principalId": "1111:example-user",
            "sessionContext":
              {
                "attributes":
                  {
                    "creationDate": "2019-01-01T00:00:00Z",
                    "mfaAuthenticated": "true",
                  },
                "sessionIssuer":
                  {
                    "accountId": "123456789012",
                    "arn": "arn:aws:iam::123456789012:role/example-role",
                    "principalId": "1111",
                    "type": "Role",
                    "userName": "example-user",
                  },
              },
            "type": "AssumedRole",
          },
      }
  - Name: IAM Read Only Activity
    ExpectedResult: false
    Log:
      {
        "awsRegion": "us-east-1",
        "eventID": "1111",
        "eventName": "DescribePolicy",
        "eventSource": "iam.amazonaws.com",
        "eventTime": "2019-01-01T00:00:00Z",
        "eventType": "AwsApiCall",
        "eventVersion": "1.05",
        "recipientAccountId": "123456789012",
        "requestID": "1111",
        "requestParameters": { "roleName": "LambdaFunctionRole-1111" },
        "responseElements": null,
        "sourceIPAddress": "111.111.111.111",
        "userAgent": "cloudformation.amazonaws.com",
        "userIdentity":
          {
            "accesKeyId": "1111",
            "accessKeyId": "1111",
            "accountId": "123456789012",
            "arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-user",
            "invokedBy": "cloudformation.amazonaws.com",
            "principalId": "1111:example-user",
            "sessionContext":
              {
                "attributes":
                  {
                    "creationDate": "2019-01-01T00:00:00Z",
                    "mfaAuthenticated": "true",
                  },
                "sessionIssuer":
                  {
                    "accountId": "123456789012",
                    "arn": "arn:aws:iam::123456789012:role/example-role",
                    "principalId": "1111",
                    "type": "Role",
                    "userName": "example-user",
                  },
              },
            "type": "AssumedRole",
          },
      }
  - Name: Error Making IAM Change
    ExpectedResult: false
    Log:
      {
        "awsRegion": "us-east-1",
        "errorCode": "NoSuchEntity",
        "eventID": "1111",
        "eventName": "AttachRolePolicy",
        "eventSource": "iam.amazonaws.com",
        "eventTime": "2019-01-01T00:00:00Z",
        "eventType": "AwsApiCall",
        "eventVersion": "1.05",
        "recipientAccountId": "123456789012",
        "requestID": "1111",
        "requestParameters":
          {
            "policyArn": "arn:aws:iam::aws:policy/example-policy",
            "roleName": "LambdaFunctionRole-1111",
          },
        "responseElements": null,
        "sourceIPAddress": "111.111.111.111",
        "userAgent": "cloudformation.amazonaws.com",
        "userIdentity":
          {
            "accesKeyId": "1111",
            "accessKeyId": "1111",
            "accountId": "123456789012",
            "arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-user",
            "invokedBy": "cloudformation.amazonaws.com",
            "principalId": "1111:example-user",
            "sessionContext":
              {
                "attributes":
                  {
                    "creationDate": "2019-01-01T00:00:00Z",
                    "mfaAuthenticated": "true",
                  },
                "sessionIssuer":
                  {
                    "accountId": "123456789012",
                    "arn": "arn:aws:iam::123456789012:role/example-role",
                    "principalId": "1111",
                    "type": "Role",
                    "userName": "example-user",
                  },
              },
            "type": "AssumedRole",
          },
      }


# ------ paired body: aws_iam_anything_changed.py ------

from panther_aws_helpers import aws_cloudtrail_success, aws_rule_context

IAM_CHANGE_ACTIONS = [
    "Add",
    "Attach",
    "Change",
    "Create",
    "Deactivate",
    "Delete",
    "Detach",
    "Enable",
    "Put",
    "Remove",
    "Set",
    "Update",
    "Upload",
]


def rule(event):
    # Only check IAM events, as the next check is relatively computationally
    # expensive and can often be skipped
    if not aws_cloudtrail_success(event) or event.get("eventSource") != "iam.amazonaws.com":
        return False

    return any((event.get("eventName", "").startswith(action) for action in IAM_CHANGE_ACTIONS))


def alert_context(event):
    return aws_rule_context(event)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.