Logins Without SAML

AnalysisType: rule
Filename: aws_console_login_without_saml.py
RuleID: "AWS.Console.LoginWithoutSAML"
DisplayName: "Logins Without SAML"
DedupPeriodMinutes: 60
Enabled: false
LogTypes:
  - AWS.CloudTrail
Reports:
  MITRE ATT&CK:
    - TA0001:T1078
Tags:
  - AWS
  - Configuration Required
  - Identity & Access Management
  - Authentication
  - Initial Access:Valid Accounts
Severity: High
Description: An AWS console login was made without SAML/SSO.
Runbook: Modify the AWS account configuration.
Reference: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-saml.html
SummaryAttributes:
  - userAgent
  - sourceIpAddress
  - recipientAccountId
  - p_any_aws_arns
Tests:
  - Name: Login with SAML
    ExpectedResult: false
    Log:
      {
        "additionalEventData":
          {
            "LoginTo": "https://console.aws.amazon.com/console/home",
            "MobileVersion": "No",
            "MFAUsed": "No",
            "SamlProviderArn": "arn:aws:iam::123456789012:saml-provider/Okta",
          },
        "eventVersion": "1.05",
        "userIdentity":
          {
            "type": "AssumedRole",
            "principalId": "1111",
            "arn": "arn:aws:iam::123456789012:assumed-role/okta/tester@domain.tld",
            "accountId": "123456789012",
            "userName": "tester",
          },
        "eventTime": "2019-01-01T00:00:00Z",
        "eventSource": "signin.amazonaws.com",
        "eventName": "ConsoleLogin",
        "awsRegion": "us-east-1",
        "sourceIPAddress": "111.111.111.111",
        "userAgent": "Mozilla",
        "requestParameters": null,
        "responseElements": { "ConsoleLogin": "Success" },
        "eventID": "1",
        "eventType": "AwsConsoleSignIn",
        "recipientAccountId": "123456789012",
      }
  - Name: Normal Login
    ExpectedResult: true
    Log:
      {
        "eventVersion": "1.05",
        "userIdentity":
          {
            "type": "IAMUser",
            "principalId": "1111",
            "arn": "arn:aws:iam::123456789012:user/tester",
            "accountId": "123456789012",
            "userName": "tester",
          },
        "eventTime": "2019-01-01T00:00:00Z",
        "eventSource": "signin.amazonaws.com",
        "eventName": "ConsoleLogin",
        "awsRegion": "us-east-1",
        "sourceIPAddress": "111.111.111.111",
        "userAgent": "Mozilla",
        "requestParameters": null,
        "responseElements": { "ConsoleLogin": "Success" },
        "additionalEventData":
          {
            "LoginTo": "https://console.aws.amazon.com/console/",
            "MobileVersion": "No",
            "MFAUsed": "Yes",
          },
        "eventID": "1",
        "eventType": "AwsConsoleSignIn",
        "recipientAccountId": "123456789012",
      }


# ------ paired body: aws_console_login_without_saml.py ------

from panther_aws_helpers import aws_rule_context


def rule(event):
    additional_event_data = event.get("additionalEventData", {})
    return (
        event.get("eventName") == "ConsoleLogin"
        and event.deep_get("userIdentity", "type") != "AssumedRole"
        and not additional_event_data.get("SamlProviderArn")
    )


def title(event):
    return f"AWS logins without SAML in account " f"[{event.get('recipientAccountId')}]"


def alert_context(event):
    return aws_rule_context(event)