queries and tests

panther-labs · Dec 2, 2024 · 057c96b · 057c96b
1 parent 3ea49aa
commit 057c96b
Show file tree

Hide file tree

Showing 4 changed files with 10 additions and 5 deletions.
diff --git a/queries/aws_queries/anomalous_role_assume_query.yml b/queries/aws_queries/anomalous_role_assume_query.yml
@@ -4,18 +4,18 @@ Enabled: false
 Query: |
   SELECT
     requestParameters:roleArn as roleArn,
-    userIdentity:principalId as principalId,
+    userIdentity:credentialId as credentialId,
     count(DISTINCT userAgent) as distinctUserAgents
   FROM
     panther_logs.public.aws_cloudtrail
   WHERE
     eventSource = 'sts.amazonaws.com'
     and eventName = 'AssumeRole'
     and p_occurs_since('1 days')
-    and userIdentity:principalId != 'null'
+    and userIdentity:credentialId != 'null'
     and userAgent != 'AWS Internal'
     and requestParameters:roleArn != 'null'
-  GROUP BY requestParameters:roleArn, userIdentity:principalId
+  GROUP BY requestParameters:roleArn, userIdentity:credentialId
   HAVING count(DISTINCT userAgent) > 1
   ORDER BY count(DISTINCT userAgent) DESC
 QueryName: "RoleAssumes by Multiple Useragents"

diff --git a/queries/aws_queries/aws_potentially_compromised_service_role_query.yml b/queries/aws_queries/aws_potentially_compromised_service_role_query.yml
@@ -4,7 +4,7 @@ Enabled: false
 Query: |
   SELECT
     requestParameters:roleArn AS role,
-    ARRAY_AGG(distinct userIdentity:principalId) AS users,
+    ARRAY_AGG(distinct userIdentity:credentialId) AS users,
     ARRAY_AGG(distinct userIdentity:type) AS types
   FROM
     panther_logs.public.aws_cloudtrail

diff --git a/rules/aws_cloudtrail_rules/aws_key_compromised.py b/rules/aws_cloudtrail_rules/aws_key_compromised.py
@@ -14,7 +14,7 @@ def rule(event):
 
 
 def dedup(event):
-    return event.deep_get("additionalEventData", "UserName")
+    return event.deep_get("additionalEventData", "UserName", default="<NO_USERNAME>")
 
 
 def title(event):

diff --git a/rules/aws_cloudtrail_rules/aws_key_compromised.yml b/rules/aws_cloudtrail_rules/aws_key_compromised.yml
@@ -32,6 +32,11 @@ Tests:
             "arn": "arn:aws:iam::123456789012:user/compromised_user",
             "accountId": "123456789012",
           },
+        "additionalEventData": 
+          {
+            "CredentialType": "PASSWORD",
+            "UserName": "anyuser"
+          },
         "eventName": "PutUserPolicy",
         "eventVersion": "1.05",
         "userAgent": "aws-internal/3 aws-sdk-java/1.11.706 Linux/4.9.184-0.1.ac.235.83.329.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.242-b08 java/1.8.0_242 vendor/Oracle_Corporation",