Detect Reconnaissance from IAM Users

Description

An IAM user has a high volume of access denied API calls.

Query · python

from ipaddress import ip_address

from panther_aws_helpers import aws_rule_context

# service/event patterns to monitor
RECON_ACTIONS = {
    "dynamodb": ["List", "Describe", "Get"],
    "ec2": ["Describe", "Get"],
    "iam": ["List", "Get"],
    "s3": ["List", "Get"],
    "rds": ["Describe", "List"],
}


def rule(event):
    # Filter events
    if event.get("errorCode") != "AccessDenied":
        return False
    if event.deep_get("userIdentity", "type") != "IAMUser":
        return False

    # Console Activity can easily result in false positives as some pages contain a mix of
    # items that a user may or may not have access to.
    if event.get("userAgent").startswith("aws-internal/3"):
        return False

    # Validate the request came from outside of AWS
    try:
        ip_address(event.get("sourceIPAddress"))
    except ValueError:
        return False

    # Pattern match this event to the recon actions
    for event_source, event_patterns in RECON_ACTIONS.items():
        if event.get("eventSource", "").startswith(event_source) and any(
            event.get("eventName", "").startswith(event_pattern) for event_pattern in event_patterns
        ):
            return True
    return False


def dedup(event):
    return event.deep_get("userIdentity", "arn")


def title(event):
    user_type = event.deep_get("userIdentity", "type")
    if user_type == "IAMUser":
        user = event.deep_get("userIdentity", "userName")
    # root user
    elif user_type == "Root":
        user = user_type
    else:
        user = "<UNKNOWN_USER>"
    return (
        "Reconnaissance activity denied to user "
        f"[{user}] "
        "in account "
        f"[{event.get('recipientAccountId')}]"
    )


def alert_context(event):
    return aws_rule_context(event)

Analyst notes

Analyze the IP they came from, and other actions taken before/after.

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: Informational
Status: Stable
Query type: python
Created: —
Modified: 2024-04-02
Authored by: panther-labs
Source ID
Upstream: rules/aws_cloudtrail_rules/aws_iam_user_recon_denied.yml
Type: rule
Version: 1
References: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html
Data sources: AWS.CloudTrail

ATT&CK

TA0007 T1526