AWS CloudTrail Password Spraying

AnalysisType: rule
Filename: aws_cloudtrail_password_spraying.py
RuleID: "AWS.CloudTrail.PasswordSpraying"
DisplayName: "AWS CloudTrail Password Spraying"
Status: Experimental
Enabled: false
Severity: Medium
DedupPeriodMinutes: 60
Threshold: 10
LogTypes:
  - AWS.CloudTrail
Description: >
  Detects password spraying attacks by alerting when more than 9 distinct usernames
  fail to authenticate to the AWS console from the same account and region within 60 minutes.
Reports:
  MITRE ATT&CK:
    - TA0001:T1078
Tags:
  - Initial Access:Valid Accounts
Runbook: |
  1. Query CloudTrail for all ConsoleLogin events in the 2 hours around this alert grouped by sourceIPAddress to identify the origin of the spray targeting recipientAccountId
  2. Check if any of the targeted usernames subsequently had a successful ConsoleLogin from any sourceIPAddress in the 6 hours after the alert
  3. Find other alerts for this recipientAccountId or any of the targeted usernames in the past 7 days to determine if this is part of a broader campaign
Tests:
  - Name: Failed Console Login
    ExpectedResult: true
    Log:
      awsRegion: us-east-1
      eventName: ConsoleLogin
      eventSource: signin.amazonaws.com
      eventType: AwsConsoleSignIn
      recipientAccountId: "111122223333"
      responseElements:
        ConsoleLogin: Failure
      userIdentity:
        type: IAMUser
        userName: alice
  - Name: Successful Console Login
    ExpectedResult: false
    Log:
      awsRegion: us-east-1
      eventName: ConsoleLogin
      eventSource: signin.amazonaws.com
      eventType: AwsConsoleSignIn
      recipientAccountId: "111122223333"
      responseElements:
        ConsoleLogin: Success
      userIdentity:
        type: IAMUser
        userName: alice
  - Name: Non-Console Event
    ExpectedResult: false
    Log:
      awsRegion: us-east-1
      eventName: DescribeInstances
      eventSource: ec2.amazonaws.com
      eventType: AwsApiCall
      recipientAccountId: "111122223333"
      responseElements: null
      userIdentity:
        type: IAMUser
        userName: alice
  - Name: Failed Console Login - Root User
    ExpectedResult: true
    Log:
      awsRegion: us-east-1
      eventName: ConsoleLogin
      eventSource: signin.amazonaws.com
      eventType: AwsConsoleSignIn
      recipientAccountId: "111122223333"
      responseElements:
        ConsoleLogin: Failure
      userIdentity:
        type: Root
        userName: root


# ------ paired body: aws_cloudtrail_password_spraying.py ------

from panther_aws_helpers import aws_rule_context


def rule(event):
    if event.get("eventType") != "AwsConsoleSignIn":
        return False
    return event.deep_get("responseElements", "ConsoleLogin", default="") == "Failure"


def title(event):
    account = event.get("recipientAccountId", "Unknown Account")
    region = event.get("awsRegion", "Unknown Region")
    return f"Password Spraying Detected in AWS Account [{account}] Region [{region}]"


def dedup(event):
    account = event.get("recipientAccountId", "")
    region = event.get("awsRegion", "")
    return f"{account}:{region}"


def unique(event):
    return event.deep_get("userIdentity", "userName") or None


def severity(event):
    if event.deep_get("userIdentity", "type", default="") == "Root":
        return "HIGH"
    return "DEFAULT"


def alert_context(event):
    return aws_rule_context(event)