Panther informational experimental python

AWS EC2 Discovery Commands Executed

Multiple different discovery commands were executed by the same EC2 instance. This could indicate a compromised instance.

View Source

Detection Logic

from panther_aws_helpers import aws_rule_context
from panther_core import PantherEvent


def rule(_):
    return True


def title(event: PantherEvent):
    account = event.get("recipientAccountId")
    instance_id = event.deep_get("userIdentity", "arn").split("/")[-1]
    return f"{account}: Multiple Discovery Commands Executed on EC2 Instance '{instance_id}'"


def alert_context(event: PantherEvent):
    return aws_rule_context(event)

Field Validations

Loading…

Comments (0)

Loading comments...