AWS User Takeover Via Password Reset

Query

Detection:
    - Group:
        - ID: Password Reset
          RuleID: AWS.CloudTrail.LoginProfileCreatedOrModified
        - ID: Login
          RuleID: AWS.Console.Login
      MatchCriteria:
        field_name:
          - GroupID: Password Reset
            Match: p_alert_context.ip_and_username
          - GroupID: Login
            Match: p_alert_context.ip_and_username
      Schedule:
        RateMinutes: 1440
        TimeoutMinutes: 10
      LookbackWindowMinutes: 1800

Rule dependencies

⚠ Higher-order rule. It fires on other rules' alerts, not on raw events, so it cannot fire on its own. Deploy the rules it depends on too.

Depends on

Raw source AWS User Takeover Via Password Reset · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: correlation_rule
RuleID: "AWS.User.Takeover.Via.Password.Reset.Group"
DisplayName: "AWS User Takeover Via Password Reset"
Enabled: false
Severity: High
Reports:
  MITRE ATT&CK:
    - TA0004:T1098.001 # Additional Cloud Credentials
Detection:
    - Group:
        - ID: Password Reset
          RuleID: AWS.CloudTrail.LoginProfileCreatedOrModified
        - ID: Login
          RuleID: AWS.Console.Login
      MatchCriteria:
        field_name:
          - GroupID: Password Reset
            Match: p_alert_context.ip_and_username
          - GroupID: Login
            Match: p_alert_context.ip_and_username
      Schedule:
        RateMinutes: 1440
        TimeoutMinutes: 10
      LookbackWindowMinutes: 1800
Tests:
    - Name: Password Reset, Then Login From Same IP
      ExpectedResult: true
      RuleOutputs:
        - ID: Password Reset
          Matches:
            p_alert_context.ip_and_username:
              "1.1.1.1alice":
                - "2024-06-01T10:01:01Z"
        - ID: Login
          Matches:
            p_alert_context.ip_and_username:
              "1.1.1.1alice":
                - "2024-06-01T10:02:01Z"
    - Name: Password Reset, Then Login From different user
      ExpectedResult: false
      RuleOutputs:
        - ID: Password Reset
          Matches:
            p_alert_context.ip_and_username:
              "1.1.1.1alice":
                - "2024-06-01T10:01:01Z"
        - ID: Login
          Matches:
            p_alert_context.ip_and_username:
              "1.1.1.1bob":
                - "2024-06-01T10:02:01Z"
    - Name: Password Reset, Then Login From Different IPs
      ExpectedResult: false
      RuleOutputs:
        - ID: Password Reset
          Matches:
            p_alert_context.ip_and_username:
              "1.1.1.1alice":
                - "2024-06-01T10:01:01Z"
        - ID: Login
          Matches:
            p_alert_context.ip_and_username:
              "2.2.2.2alice":
                - "2024-06-01T10:02:01Z"
    - Name: Password Reset Without Login
      ExpectedResult: false
      RuleOutputs:
        - ID: Password Reset
          Matches:
            p_alert_context.ip_and_username:
              "1.1.1.1alice":
                - "2024-06-01T10:01:01Z"
    - Name: Login Without Password Reset
      ExpectedResult: false
      RuleOutputs:
        - ID: Login
          Matches:
            p_alert_context.ip_and_username:
              "1.1.1.1alice":
                - "2024-06-01T10:01:01Z"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.