AWS command executed on the command line

AnalysisType: rule
Filename: osquery_linux_aws_commands.py
RuleID: "Osquery.Linux.AWSCommandExecuted"
DisplayName: "AWS command executed on the command line"
Enabled: true
LogTypes:
  - Osquery.Differential
Tags:
  - Osquery
  - Linux
  - Execution:User Execution
Reports:
  MITRE ATT&CK:
    - TA0002:T1204
Severity: Medium
Description: An AWS command was executed on a Linux instance
Runbook: See which other commands were executed, and then remove IAM role causing the access
Reference: https://attack.mitre.org/techniques/T1078/
SummaryAttributes:
  - name
  - action
Tests:
  - Name: AWS command executed on MacOS
    ExpectedResult: false
    Log:
      {
        "name": "pack_incident-response_shell_history",
        "action": "added",
        "decorations": { "platform": "darwin" },
        "columns":
          {
            "command": "aws sts get-caller-identity",
            "uid": "1000",
            "directory": "/home/ubuntu",
            "username": "ubuntu",
          },
      }
  - Name: AWS command executed
    ExpectedResult: true
    Log:
      {
        "name": "pack_incident-response_shell_history",
        "action": "added",
        "columns":
          {
            "command": "aws s3 ls",
            "uid": "1000",
            "directory": "/home/ubuntu",
            "username": "ubuntu",
          },
      }
  - Name: Tail command executed
    ExpectedResult: false
    Log:
      {
        "name": "pack_incident-response_shell_history",
        "action": "added",
        "columns":
          {
            "command": "tail -f /var/log/all",
            "uid": "1000",
            "directory": "/home/ubuntu",
            "username": "ubuntu",
          },
      }
  - Name: Command with quote executed
    ExpectedResult: false
    Log:
      {
        "name": "pack_incident-response_shell_history",
        "action": "added",
        "columns":
          {
            "command": "git commit -m 'all done'",
            "uid": "1000",
            "directory": "/home/ubuntu",
            "username": "ubuntu",
          },
      }
  - Name: Invalid command ignored
    ExpectedResult: false
    Log:
      {
        "name": "pack_incident-response_shell_history",
        "action": "added",
        "columns":
          {
            "command": "unopened '",
            "uid": "1000",
            "directory": "/home/ubuntu",
            "username": "ubuntu",
          },
      }


# ------ paired body: osquery_linux_aws_commands.py ------

import shlex

PLATFORM_IGNORE_LIST = {"darwin"}


def rule(event):
    # Filter out irrelevant logs & systems
    if (
        event.get("action") != "added"
        or "shell_history" not in event.get("name")
        or event.deep_get("decorations", "platform") in PLATFORM_IGNORE_LIST
    ):
        return False

    command = event.deep_get("columns", "command")
    if not command:
        return False
    try:
        command_args = shlex.split(command)
    except ValueError:
        # "No escaped character" or "No closing quotation", probably an invalid command
        return False

    if command_args[0] == "aws":
        return True

    return False


def title(event):
    return (
        f"User [{event.deep_get('columns', 'username', default='<UNKNOWN_USER>')}] issued an"
        f" aws-cli command on [{event.get('hostIdentifier', '<UNKNOWN_HOST>')}]"
    )