New IAM Credentials Updated

AnalysisType: rule
Filename: aws_update_credentials.py
RuleID: "AWS.IAM.CredentialsUpdated"
DisplayName: "New IAM Credentials Updated"
Enabled: true
LogTypes:
  - AWS.CloudTrail
Reports:
  MITRE ATT&CK:
    - TA0003:T1098

  Stratus Red Team:
    - aws.persistence.iam-backdoor-user
    - aws.persistence.iam-create-admin-user
    - aws.persistence.iam-create-user-login-profile
Tags:
  - AWS
  - Identity & Access Management
  - Persistence:Account Manipulation
Severity: Info
Description: A console password, access key, or user has been created.
Runbook: This rule is purely informational, there is no action needed.
Reference: https://docs.aws.amazon.com/IAM/latest/UserGuide/list_identityandaccessmanagement.html
SummaryAttributes:
  - eventName
  - userAgent
  - sourceIpAddress
  - recipientAccountId
  - p_any_aws_arns
Tests:
  - Name: User Password Was Changed
    ExpectedResult: true
    Log:
      {
        "eventVersion": "1.05",
        "userIdentity":
          {
            "type": "IAMUser",
            "principalId": "AAAAIIIIIIU74NPJW5K76",
            "arn": "arn:aws:iam::123456789012:user/test_user",
            "accountId": "123456789012",
            "accessKeyId": "AAAAIIIIIIU74NPJW5K76",
            "userName": "test_user",
            "sessionContext":
              {
                "attributes":
                  {
                    "mfaAuthenticated": "true",
                    "creationDate": "2019-12-31T01:50:17Z",
                  },
              },
            "invokedBy": "signin.amazonaws.com",
          },
        "eventTime": "2019-12-31T01:50:46Z",
        "eventSource": "iam.amazonaws.com",
        "eventName": "ChangePassword",
        "awsRegion": "us-east-1",
        "sourceIPAddress": "64.25.27.224",
        "userAgent": "signin.amazonaws.com",
        "requestParameters": null,
        "responseElements": null,
        "requestID": "a431f05e-67e1-11ea-bc55-0242ac130003",
        "eventID": "a431f05e-67e1-11ea-bc55-0242ac130003",
        "readOnly": false,
        "eventType": "AwsApiCall",
        "recipientAccountId": "123456789012",
      }
  - Name: MFA Device Was Created
    ExpectedResult: false
    Log:
      {
        "eventVersion": "1.05",
        "userIdentity":
          {
            "type": "IAMUser",
            "principalId": "AAAAIIIIIIU74NPJW5K76",
            "arn": "arn:aws:iam::123456789012:user/test_user",
            "accountId": "123456789012",
            "accessKeyId": "AAAAIIIIIIU74NPJW5K76",
            "userName": "test_user",
            "sessionContext":
              {
                "attributes":
                  {
                    "mfaAuthenticated": "true",
                    "creationDate": "2019-12-31T01:50:17Z",
                  },
              },
            "invokedBy": "signin.amazonaws.com",
          },
        "eventTime": "2019-12-31T01:50:46Z",
        "eventSource": "iam.amazonaws.com",
        "eventName": "CreateVirtualMFADevice",
        "awsRegion": "us-east-1",
        "sourceIPAddress": "64.25.27.224",
        "userAgent": "signin.amazonaws.com",
        "requestParameters": null,
        "responseElements": null,
        "requestID": "a431f05e-67e1-11ea-bc55-0242ac130003",
        "eventID": "a431f05e-67e1-11ea-bc55-0242ac130003",
        "readOnly": false,
        "eventType": "AwsApiCall",
        "recipientAccountId": "123456789012",
      }
  - Name: User Password Change Error
    ExpectedResult: false
    Log:
      {
        "eventVersion": "1.05",
        "errorCode": "PasswordPolicyViolation",
        "userIdentity":
          {
            "type": "IAMUser",
            "principalId": "AAAAIIIIIIU74NPJW5K76",
            "arn": "arn:aws:iam::123456789012:user/test_user",
            "accountId": "123456789012",
            "accessKeyId": "AAAAIIIIIIU74NPJW5K76",
            "userName": "test_user",
            "sessionContext":
              {
                "attributes":
                  {
                    "mfaAuthenticated": "true",
                    "creationDate": "2019-12-31T01:50:17Z",
                  },
              },
            "invokedBy": "signin.amazonaws.com",
          },
        "eventTime": "2019-12-31T01:50:46Z",
        "eventSource": "iam.amazonaws.com",
        "eventName": "ChangePassword",
        "awsRegion": "us-east-1",
        "sourceIPAddress": "64.25.27.224",
        "userAgent": "signin.amazonaws.com",
        "requestParameters": null,
        "responseElements": null,
        "requestID": "a431f05e-67e1-11ea-bc55-0242ac130003",
        "eventID": "a431f05e-67e1-11ea-bc55-0242ac130003",
        "readOnly": false,
        "eventType": "AwsApiCall",
        "recipientAccountId": "123456789012",
      }


# ------ paired body: aws_update_credentials.py ------

from panther_aws_helpers import aws_cloudtrail_success, aws_rule_context

UPDATE_EVENTS = {"ChangePassword", "CreateAccessKey", "CreateLoginProfile", "CreateUser"}


def rule(event):
    return event.get("eventName") in UPDATE_EVENTS and aws_cloudtrail_success(event)


def dedup(event):
    return event.deep_get("userIdentity", "userName", default="<UNKNOWN_USER>")


def title(event):
    return (
        f"{event.deep_get('userIdentity', 'type')} [{event.deep_get('userIdentity', 'arn')}]"
        f" has updated their IAM credentials"
    )


def alert_context(event):
    return aws_rule_context(event)