Detect Reconnaissance from IAM Users

from ipaddress import ip_address

from panther_aws_helpers import aws_rule_context

# service/event patterns to monitor
RECON_ACTIONS = {
    "dynamodb": ["List", "Describe", "Get"],
    "ec2": ["Describe", "Get"],
    "iam": ["List", "Get"],
    "s3": ["List", "Get"],
    "rds": ["Describe", "List"],
}


def rule(event):
    # Filter events
    if event.get("errorCode") != "AccessDenied":
        return False
    if event.deep_get("userIdentity", "type") != "IAMUser":
        return False

    # Console Activity can easily result in false positives as some pages contain a mix of
    # items that a user may or may not have access to.
    if event.get("userAgent").startswith("aws-internal/3"):
        return False

    # Validate the request came from outside of AWS
    try:
        ip_address(event.get("sourceIPAddress"))
    except ValueError:
        return False

    # Pattern match this event to the recon actions
    for event_source, event_patterns in RECON_ACTIONS.items():
        if event.get("eventSource", "").startswith(event_source) and any(
            event.get("eventName", "").startswith(event_pattern) for event_pattern in event_patterns
        ):
            return True
    return False


def dedup(event):
    return event.deep_get("userIdentity", "arn")


def title(event):
    user_type = event.deep_get("userIdentity", "type")
    if user_type == "IAMUser":
        user = event.deep_get("userIdentity", "userName")
    # root user
    elif user_type == "Root":
        user = user_type
    else:
        user = "<UNKNOWN_USER>"
    return (
        "Reconnaissance activity denied to user "
        f"[{user}] "
        "in account "
        f"[{event.get('recipientAccountId')}]"
    )


def alert_context(event):
    return aws_rule_context(event)