AWS Trusted IPSet Modified

AnalysisType: rule
Description: "Detects creation and updates of the list of trusted IPs used by GuardDuty and WAF. Potentially to disable security alerts against malicious IPs."
DisplayName: "AWS Trusted IPSet Modified"
Enabled: true
Filename: aws_ipset_modified.py
Reports:
  MITRE ATT&CK:
    - TA0005:T1562
Reference: https://docs.aws.amazon.com/managedservices/latest/ctref/management-monitoring-guardduty-ip-set-update-review-required.html
Severity: High
Tests:
  - ExpectedResult: true
    Log:
      awsregion: us-east-1
      eventid: abc-123
      eventname: CreateIPSet
      eventsource: guardduty.amazonaws.com
      eventtime: "2022-07-17 04:50:23"
      eventtype: AwsApiCall
      eventversion: "1.08"
      p_any_aws_instance_ids:
        - testinstanceid
      p_event_time: "2022-07-17 04:50:23"
      p_log_type: AWS.CloudTrail
      p_parse_time: "2022-07-17 04:55:11.788"
      recipientAccountId: "123456789012"
    Name: CreateIPSet Event
  - ExpectedResult: true
    Log:
      awsregion: us-east-1
      eventid: abc-123
      eventname: CreateIPSet
      eventsource: guardduty.amazonaws.com
      eventtime: "2022-07-17 04:50:23"
      eventtype: AwsApiCall
      eventversion: "1.08"
      p_any_aws_instance_ids:
        - testinstanceid
      p_event_time: "2022-07-17 04:50:23"
      p_log_type: AWS.CloudTrail
      p_parse_time: "2022-07-17 04:55:11.788"
      recipientAccountId: "123456789012"
    Name: UpdateIPSet
  - ExpectedResult: false
    Log:
      awsregion: us-east-1
      eventid: abc-123
      eventname: ModifyInstanceAttributes
      eventsource: guardduty.amazonaws.com
      eventtime: "2022-07-17 04:50:23"
      eventtype: AwsApiCall
      eventversion: "1.08"
      p_any_aws_instance_ids:
        - testinstanceid
      p_event_time: "2022-07-17 04:50:23"
      p_log_type: AWS.CloudTrail
      p_parse_time: "2022-07-17 04:55:11.788"
      recipientAccountId: "123456789012"
    Name: NotIPSet
DedupPeriodMinutes: 60
LogTypes:
  - AWS.CloudTrail
RuleID: "AWS.IPSet.Modified"
Threshold: 1


# ------ paired body: aws_ipset_modified.py ------

from panther_aws_helpers import aws_rule_context

IPSET_ACTIONS = ["CreateIPSet", "UpdateIPSet"]


def rule(event):
    if (
        event.get("eventSource", "") == "guardduty.amazonaws.com"
        or event.get("eventSource", "") == "wafv2.amazonaws.com"
    ):
        if event.get("eventName", "") in IPSET_ACTIONS:
            return True
    return False


def title(event):
    return "IPSet was modified in " f"[{event.get('recipientAccountId','')}]"


def alert_context(event):
    return aws_rule_context(event)