Add rule to alert on known cryptomining ports in VPC flow logs

[egibs]

Background

This PR adds a rule to look for known cryptomining ports in VPC flow logs. The rule also contains an empty set that can hold known destination addresses to avoid alerts when a more common port is detected for outbound traffic to a public address (8080, for instance).

Changes

• Adds a set of CRYPTO_MINING_PORTS to panther-iocs.py
• Adds a new aws_vpc_crypto_ports.py rule which consumes the aforementioned set
• Adds aws_vpc_crypto_ports.yml with a few tests (nothing elaborate since we're emulating flow logs)

Testing

• make fmt; make lint; make test

[arielkr256]

I would set this one to be disabled by default with a lower severity, since it will primarily be used as a building block for correlation rules. By itself it will probably be very noisy.

[egibs]

I would set this one to be disabled by default with a lower severity, since it will primarily be used as a building block for correlation rules. By itself it will probably be very noisy.

That was in the back of my mind -- I think this is a safer idea.

[rleighton]

I've done crypto mining detections before ... this will be VERY noisy. Better to use a list of domain names w/VPCdns.

Also, AFAIK VPC flow logs are uni-directional so dst likely does not have the meaning you think it does.

Did you test this on KoS?

This rule seems very dubious.

[egibs]

I've done crypto mining detections before ... this will be VERY noisy. Better to use a list of domain names w/VPCdns.

Also, AFAIK VPC flow logs are uni-directional so dst likely does not have the meaning you think it does.

Did you test this on KoS?

This rule seems very dubious.

The plan is to potentially leverage the rule for correlations. We already have DNS rules in place that do work for these types of detections, so this will be supplemental at most and will not be relied upon as a primary rule.