ECR CRUD Actions

Description

Unauthorized ECR Create, Read, Update, or Delete event occurred.

Query · python

from fnmatch import fnmatch

from panther_aws_helpers import aws_rule_context

ECR_CRUD_EVENTS = {
    "BatchCheckLayerAvailability",
    "BatchDeleteImage",
    "BatchGetImage",
    "CompleteLayerUpload",
    "CreateRepository",
    "DeleteRepository",
    "DeleteRepositoryPolicy",
    "GetAuthorizationToken",
    "GetDownloadUrlForLayer",
    "GetRepositoryPolicy",
    "InitiateLayerUpload",
    "PutImage",
    "SetRepositoryPolicy",
    "UploadLayerPart",
}

ALLOWED_ROLES = [
    "*DeployRole",
]


def rule(event):
    if (
        event.get("eventSource") == "ecr.amazonaws.com"
        and event.get("eventName") in ECR_CRUD_EVENTS
    ):
        for role in ALLOWED_ROLES:
            if fnmatch(event.deep_get("userIdentity", "arn", default="unknown-arn"), role):
                return False

        return True
    return False


def title(event):
    return (
        f"[{event.deep_get('userIdentity','arn', default = 'unknown-arn')}] "
        f"performed ECR {event.get('eventName')} in "
        f"[{event.get('recipientAccountId')} {event.get('awsRegion')}]."
    )


def dedup(event):
    return f"{event.deep_get('userIdentity','arn', default = 'unknown-arn')}"


def alert_context(event):
    return aws_rule_context(event)

Analyst notes

https://docs.aws.amazon.com/AmazonECR/latest/userguide/logging-using-cloudtrail.html

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: Informational
Status: Experimental
Query type: python
Created: 2022-10-03
Modified: 2024-08-15
Authored by: panther-labs
Source ID
Upstream: rules/aws_cloudtrail_rules/aws_ecr_crud.yml
Type: rule
Version: 1
References: https://docs.aws.amazon.com/AmazonECR/latest/userguide/security-iam.html#security_iam_authentication
Data sources: AWS.CloudTrail

ATT&CK

TA0005 T1525