Monitor Unauthorized API Calls

AnalysisType: rule
Filename: aws_unauthorized_api_call.py
RuleID: "AWS.CloudTrail.UnauthorizedAPICall"
DisplayName: "Monitor Unauthorized API Calls"
Enabled: true
DedupPeriodMinutes: 1440 # 24 hours
LogTypes:
  - AWS.CloudTrail
Tags:
  - AWS
  - Discovery:Cloud Service Discovery
Reports:
  CIS:
    - 3.1
  MITRE ATT&CK:
    - TA0007:T1526
Severity: Info
CreateAlert: false
Description: An unauthorized AWS API call was made
Runbook: https://docs.runpanther.io/alert-runbooks/built-in-rules/aws-unauthorized-api-call
Reference: https://amzn.to/3aOukaA
SummaryAttributes:
  - eventName
  - userAgent
  - sourceIpAddress
  - recipientAccountId
  - p_any_aws_arns
Threshold: 20
Tests:
  - Name: Unauthorized API Call from Within AWS (IP)
    ExpectedResult: true
    Log:
      {
        "eventVersion": "1.05",
        "userIdentity":
          {
            "type": "IAMUser",
            "principalId": "1111",
            "arn": "arn:aws:iam::123456789012:user/tester",
            "accountId": "123456789012",
            "accessKeyId": "1",
            "userName": "tester",
            "sessionContext":
              {
                "attributes":
                  {
                    "mfaAuthenticated": "true",
                    "creationDate": "2019-01-01T00:00:00Z",
                  },
              },
            "invokedBy": "signin.amazonaws.com",
          },
        "eventTime": "2019-01-01T00:00:00Z",
        "eventSource": "iam.amazonaws.com",
        "eventName": "CreateServiceLinkedRole",
        "awsRegion": "us-east-1",
        "sourceIPAddress": "3.10.107.144",
        "errorCode": "AccessDenied",
        "errorMessage": "User: arn:aws:iam::123456789012:user/tester is not authorized to perform: iam:Action on resource: arn:aws:iam::123456789012:resource",
        "userAgent": "sqs.amazonaws.com",
        "requestParameters": null,
        "responseElements": null,
        "requestID": "1",
        "eventID": "1",
        "eventType": "AwsApiCall",
        "recipientAccountId": "123456789012",
        p_log_type: "AWS.CloudTrail",
      }
  - Name: Unauthorized API Call from Within AWS (FQDN)
    ExpectedResult: false
    Log:
      {
        "eventVersion": "1.05",
        "userIdentity":
          {
            "type": "IAMUser",
            "principalId": "1111",
            "arn": "arn:aws:iam::123456789012:user/tester",
            "accountId": "123456789012",
            "accessKeyId": "1",
            "userName": "tester",
            "sessionContext":
              {
                "attributes":
                  {
                    "mfaAuthenticated": "true",
                    "creationDate": "2019-01-01T00:00:00Z",
                  },
              },
            "invokedBy": "signin.amazonaws.com",
          },
        "eventTime": "2019-01-01T00:00:00Z",
        "eventSource": "iam.amazonaws.com",
        "eventName": "CreateServiceLinkedRole",
        "awsRegion": "us-east-1",
        "sourceIPAddress": "sqs.amazonaws.com",
        "errorCode": "AccessDenied",
        "errorMessage": "User: arn:aws:iam::123456789012:user/tester is not authorized to perform: iam:Action on resource: arn:aws:iam::123456789012:resource",
        "userAgent": "sqs.amazonaws.com",
        "requestParameters": null,
        "responseElements": null,
        "requestID": "1",
        "eventID": "1",
        "eventType": "AwsApiCall",
        "recipientAccountId": "123456789012",
        p_log_type: "AWS.CloudTrail",
      }
  - Name: Authorized API Call
    ExpectedResult: false
    Log:
      {
        "eventVersion": "1.05",
        "userIdentity":
          {
            "type": "IAMUser",
            "principalId": "1111",
            "arn": "arn:aws:iam::123456789012:user/tester",
            "accountId": "123456789012",
            "accessKeyId": "1",
            "userName": "tester",
            "sessionContext":
              {
                "attributes":
                  {
                    "mfaAuthenticated": "true",
                    "creationDate": "2019-01-01T00:00:00Z",
                  },
              },
            "invokedBy": "signin.amazonaws.com",
          },
        "eventTime": "2019-01-01T00:00:00Z",
        "eventSource": "iam.amazonaws.com",
        "eventName": "CreateServiceLinkedRole",
        "awsRegion": "us-east-1",
        "sourceIPAddress": "111.111.111.111",
        "userAgent": "signin.amazonaws.com",
        "requestParameters": null,
        "responseElements": null,
        "requestID": "1",
        "eventID": "1",
        "eventType": "AwsApiCall",
        "recipientAccountId": "123456789012",
        p_log_type: "AWS.CloudTrail",
      }


# ------ paired body: aws_unauthorized_api_call.py ------

from ipaddress import ip_address

from panther_aws_helpers import aws_rule_context
from panther_misp_helpers import get_misp_warning_lists

# Do not alert on these access denied errors for these events.
# Events could be exceptions because they are particularly noisy and provide little to no value,
# or because they are expected as part of the normal operating procedure for certain tools.
EVENT_EXCEPTIONS = {
    "DescribeEventAggregates",  # Noisy, doesn't really provide any actionable info
    "ListResourceTags",  # The audit role hits this when scanning locked down resources
}


def rule(event):
    source_ip = event.get("sourceIPAddress")

    try:
        ip_address(source_ip)
    except ValueError:
        return False

    # Filter out known Amazon IP ranges
    misp_data = get_misp_warning_lists(event)
    if misp_data and misp_data.has_warning_list_id(source_ip, "amazon-aws"):
        return False

    return (
        event.get("errorCode") == "AccessDenied" and event.get("eventName") not in EVENT_EXCEPTIONS
    )


def dedup(event):
    return event.udm("actor_user")


def title(event):
    return f"Access denied to {event.deep_get('userIdentity', 'type')} [{dedup(event)}]"


def alert_context(event):
    return aws_rule_context(event)