AnalysisType: rule
Filename: aws_ec2_vpc_modified.py
RuleID: "AWS.EC2.VPCModified"
DisplayName: "EC2 VPC Modified"
Enabled: true
LogTypes:
- AWS.CloudTrail
Tags:
- AWS
- Security Control
- Defense Evasion:Impair Defenses
Reports:
CIS:
- 3.14
MITRE ATT&CK:
- TA0005:T1562
Severity: Info
DedupPeriodMinutes: 720 # 12 hours
Description: An EC2 VPC was modified.
Runbook: https://docs.runpanther.io/alert-runbooks/built-in-rules/aws-ec2-vpc-modified
Reference: https://docs.aws.amazon.com/vpc/latest/userguide/configure-your-vpc.html
SummaryAttributes:
- eventName
- userAgent
- sourceIpAddress
- recipientAccountId
- p_any_aws_arns
Tests:
- Name: VPC Modified
ExpectedResult: true
Log:
{
"eventVersion": "1.05",
"userIdentity":
{
"type": "AssumedRole",
"principalId": "1111:tester",
"arn": "arn:aws:sts::123456789012:assumed-role/tester",
"accountId": "123456789012",
"accessKeyId": "1",
"sessionContext":
{
"sessionIssuer":
{
"type": "Role",
"principalId": "1111",
"arn": "arn:aws:iam::123456789012:role/tester",
"accountId": "123456789012",
"userName": "tester",
},
"webIdFederationData": {},
"attributes":
{
"mfaAuthenticated": "true",
"creationDate": "2019-01-01T00:00:00Z",
},
},
},
"eventTime": "2019-01-01T00:00:00Z",
"eventSource": "ec2.amazonaws.com",
"eventName": "CreateVpc",
"awsRegion": "us-west-2",
"sourceIPAddress": "111.111.111.111",
"userAgent": "console.ec2.amazonaws.com",
"requestParameters":
{
"cidrBlock": "0.0.0.0/26",
"instanceTenancy": "default",
"amazonProvidedIpv6CidrBlock": false,
},
"responseElements":
{
"requestID": "1",
"vpc":
{
"vpcId": "vpc-1",
"state": "pending",
"ownerId": "123456789012",
"cidrBlock": "0.0.0.0/26",
"cidrBlockAssociationSet":
{
"items":
[
{
"cidrBlock": "0.0.0.0/26",
"associationId": "vpc-cidr-assoc-1",
"cidrBlockState": { "state": "associated" },
},
],
},
"ipv6CidrBlockAssociationSet": {},
"dhcpOptionsId": "dopt-1",
"instanceTenancy": "default",
"tagSet": {},
"isDefault": false,
},
},
"requestID": "1",
"eventID": "1",
"eventType": "AwsApiCall",
"recipientAccountId": "123456789012",
}
- Name: VPC Not Modified
ExpectedResult: false
Log:
{
"eventVersion": "1.05",
"userIdentity":
{
"type": "AssumedRole",
"principalId": "1111:tester",
"arn": "arn:aws:sts::123456789012:assumed-role/tester",
"accountId": "123456789012",
"accessKeyId": "1",
"sessionContext":
{
"sessionIssuer":
{
"type": "Role",
"principalId": "1111",
"arn": "arn:aws:iam::123456789012:role/tester",
"accountId": "123456789012",
"userName": "tester",
},
"webIdFederationData": {},
"attributes":
{
"mfaAuthenticated": "false",
"creationDate": "2019-01-01T00:00:00Z",
},
},
},
"eventTime": "2019-01-01T00:00:00Z",
"eventSource": "ec2.amazonaws.com",
"eventName": "DescribeVpcs",
"awsRegion": "us-west-2",
"sourceIPAddress": "111.111.111.111",
"userAgent": "Mozilla",
"requestParameters": { "vpcSet": {}, "filterSet": {} },
"responseElements": null,
"requestID": "1",
"eventID": "1",
"eventType": "AwsApiCall",
"recipientAccountId": "123456789012",
}
- Name: Error Modifying VPC
ExpectedResult: false
Log:
{
"errorCode": "UnknownParameter",
"eventVersion": "1.05",
"userIdentity":
{
"type": "AssumedRole",
"principalId": "1111:tester",
"arn": "arn:aws:sts::123456789012:assumed-role/tester",
"accountId": "123456789012",
"accessKeyId": "1",
"sessionContext":
{
"sessionIssuer":
{
"type": "Role",
"principalId": "1111",
"arn": "arn:aws:iam::123456789012:role/tester",
"accountId": "123456789012",
"userName": "tester",
},
"webIdFederationData": {},
"attributes":
{
"mfaAuthenticated": "true",
"creationDate": "2019-01-01T00:00:00Z",
},
},
},
"eventTime": "2019-01-01T00:00:00Z",
"eventSource": "ec2.amazonaws.com",
"eventName": "CreateVpc",
"awsRegion": "us-west-2",
"sourceIPAddress": "111.111.111.111",
"userAgent": "console.ec2.amazonaws.com",
"requestParameters":
{
"cidrBlock": "0.0.0.0/26",
"instanceTenancy": "default",
"amazonProvidedIpv6CidrBlock": false,
},
"responseElements":
{
"requestID": "1",
"vpc":
{
"vpcId": "vpc-1",
"state": "pending",
"ownerId": "123456789012",
"cidrBlock": "0.0.0.0/26",
"cidrBlockAssociationSet":
{
"items":
[
{
"cidrBlock": "0.0.0.0/26",
"associationId": "vpc-cidr-assoc-1",
"cidrBlockState": { "state": "associated" },
},
],
},
"ipv6CidrBlockAssociationSet": {},
"dhcpOptionsId": "dopt-1",
"instanceTenancy": "default",
"tagSet": {},
"isDefault": false,
},
},
"requestID": "1",
"eventID": "1",
"eventType": "AwsApiCall",
"recipientAccountId": "123456789012",
}
# ------ paired body: aws_ec2_vpc_modified.py ------
from panther_aws_helpers import aws_cloudtrail_success, aws_rule_context
# API calls that are indicative of an EC2 VPC modification
EC2_VPC_MODIFIED_EVENTS = {
"CreateVpc",
"DeleteVpc",
"ModifyVpcAttribute",
"AcceptVpcPeeringConnection",
"CreateVpcPeeringConnection",
"DeleteVpcPeeringConnection",
"RejectVpcPeeringConnection",
"AttachClassicLinkVpc",
"DetachClassicLinkVpc",
"DisableVpcClassicLink",
"EnableVpcClassicLink",
}
def rule(event):
return aws_cloudtrail_success(event) and event.get("eventName") in EC2_VPC_MODIFIED_EVENTS
def dedup(event):
return event.get("recipientAccountId")
def alert_context(event):
return aws_rule_context(event)