AWS CloudTrail Password Policy Discovery

AnalysisType: rule
Description: This detection looks for *AccountPasswordPolicy events in AWS CloudTrail logs. If these events occur in a short period of time from the same ARN, it could constitute Password Policy reconnaissance.
DisplayName: AWS CloudTrail Password Policy Discovery
Enabled: true
Filename: aws_cloudtrail_password_policy_discovery.py
Reports:
  MITRE ATT&CK:
    - TA0007:T1201
Reference: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html
Severity: Info
Tests:
  - ExpectedResult: false
    Log:
      apiversion: "2012-08-10"
      awsregion: eu-west-1
      eventcategory: Data
      eventid: 5d4b45ed-a15c-41b6-80e9-031729fa060d
      eventname: GetRecords
      eventsource: dynamodb.amazonaws.com
      eventtime: "2023-01-10 21:04:02"
      eventtype: AwsApiCall
      eventversion: "1.08"
      managementevent: false
      useridentity:
        arn: arn:aws:test_arn
    Name: Non-Discovery Event
  - ExpectedResult: true
    Log:
      awsregion: us-east-1
      eventcategory: Management
      eventid: 1808ca3b-4311-4b48-9d1f-21061acb2329
      eventname: GetAccountPasswordPolicy
      eventsource: iam.amazonaws.com
      eventtime: "2023-01-10 23:10:06"
      eventtype: AwsApiCall
      eventversion: "1.08"
      managementevent: true
      useridentity:
        arn: arn:aws:test_arn
    Name: Password Discovery ARN
  - ExpectedResult: false
    Log:
      awsregion: us-east-1
      eventType: AwsServiceEvent
      eventcategory: Management
      eventid: 1808ca3b-4311-4b48-9d1f-21061acb2329
      eventname: GetAccountPasswordPolicy
      eventsource: iam.amazonaws.com
      eventtime: "2023-01-10 23:10:06"
      eventversion: "1.08"
      managementevent: true
    Name: Password Discovery Service
DedupPeriodMinutes: 30
LogTypes:
  - AWS.CloudTrail
RuleID: AWS.CloudTrail.Password.Policy.Discovery
Threshold: 2


# ------ paired body: aws_cloudtrail_password_policy_discovery.py ------

from panther_aws_helpers import aws_rule_context

PASSWORD_DISCOVERY_EVENTS = [
    "GetAccountPasswordPolicy",
    "UpdateAccountPasswordPolicy",
    "PutAccountPasswordPolicy",
]


def rule(event):
    service_event = event.get("eventType") == "AwsServiceEvent"
    return event.get("eventName") in PASSWORD_DISCOVERY_EVENTS and not service_event


def title(event):
    user_arn = event.deep_get("useridentity", "arn", default="<MISSING_ARN>")
    return f"Password Policy Discovery detected in AWS CloudTrail from [{user_arn}]"


def alert_context(event):
    return aws_rule_context(event)