SIGNAL - Sign-in with AWS CLI prompt

Query · python

def rule(event):
    return (
        event.get("eventSource") == "sso.amazonaws.com"
        and event.get("eventName") == "ListApplications"
    )
Raw source SIGNAL - Sign-in with AWS CLI prompt · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Filename: signin_with_aws_cli_prompt.py
RuleID: "Sign-in.with.AWS.CLI.prompt"
DisplayName: "SIGNAL - Sign-in with AWS CLI prompt"
Enabled: true
CreateAlert: false
LogTypes:
    - AWS.CloudTrail
Severity: Info
DedupPeriodMinutes: 60
Threshold: 1
Tests:
    - Name: Test-291327
      ExpectedResult: true
      Log:
        eventName: ListApplications
        eventSource: sso.amazonaws.com
        eventTime: '...'
        eventVersion: "1.08"
        sourceIPAddress: <Victim source IP>
        userAgent: <Victim browser user agent>
        userIdentity:
            accountId: <organization master account ID>
            principalId: <internal victim user id>
            type: Unknown
            userName: <victim display name>


# ------ paired body: signin_with_aws_cli_prompt.py ------

def rule(event):
    return (
        event.get("eventSource") == "sso.amazonaws.com"
        and event.get("eventName") == "ListApplications"
    )

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.