Update aws_console_login_without_mfa.py by JPhenglavong · Pull Request #1237 · panther-labs/panther-analysis

JPhenglavong · 2024-05-13T13:35:23Z

is_new_account has been checking with only recipientAccountId but our new aws account indicator creation rule has been checking for "new_account - recipientAccountId..."

Adding new_account + recipientAccountId so it can match potential cached values

Background

Changes

Testing

is_new_account has been checking with only recipientAccountId but our new aws account indicator creation rule has been checking for "new_account - recipientAccountId"

Casted str to account for NoneType

JPhenglavong

casted the event.recipientAccountId to str to account for NoneType

…hout_mfa

Added an alternative string in the case udm user is empty

JPhenglavong · 2024-05-15T16:43:03Z

Hm, I'm not entirely sure why Zoom.Operations is just now requiring a {region} field, see error:
[FAIL] User Creation Event - Zoom
[FAIL] [rule] NoRegionError: You must specify a region.

Checking through https://github.com/panther-labs/panther-analysis/tree/release/rules/zoom_operation_rules and not seeing how my changes on account_id had an effect on region 🤔

Is it as simple as adding a "region" : "us-west" type of field to the test data here?

panther-analysis/rules/indicator_creation_rules/new_user_account_logging.yml

Line 85 in c8b6ad9

- Name: User Creation Event - Zoom

Going to check the zoom docs

…hout_mfa

add mock test

github-actions · 2024-06-10T17:35:20Z

😱
looks like some things could be wrong with the packs

[INFO][root]: ignoring file dependabot.yml

* Prepare for `3.53.0` (#1232) * Replace panther_analysis_tool import with updated import (#1230) * Update Action versions; use SHAs (#1231) * Update Action versions; use SHAs * Add dependabot.yml to keep Actions updated * Update PAT to 0.49.0 * auth0-cic-credential-stuffing rule and query (#1246) * Add saved queries for ongoing Snowflake threats (#1248) * Add saved queries for ongoing Snowflake threats * Add limits Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> * snowflake pack * Add scheduled queries and rules Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> * pack update * ruleID fix * make fmt Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> * Fix merge conflicts Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> * Turn off by default Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> --------- Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> Co-authored-by: Ariel Ropek <ariel.ropek@panther.com> * Update panther-core to 0.10.1 via PAT (#1249) Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> * Tweak Snowflake queries (#1250) * Tweak Snowflake queries Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> * Remove configuration drift query from Pack Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> * Threat Hunting queries are okay Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> * Fix comment Workflow Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> * 12 hours -> 1 day Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> * Update queries/snowflake_queries/snowflake_0108977_configuration_drift.yml --------- Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> Co-authored-by: Ariel Ropek <79653153+arielkr256@users.noreply.github.com> * Fixed typo in README.md (#1253) fixed 'unintall' typo to 'npm uninstall prettier' * build(deps): bump step-security/harden-runner from 2.8.0 to 2.8.1 (#1254) Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.8.0 to 2.8.1. - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@f086349...17d0e2b) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Using GITHUB_OUTPUT env var instead of old ::set-output shorthand (#1255) * OCSF data model, VPC/DNS (#1214) * Deprecate GreyNoise detections (#1205) * Deprecate GreyNoise detections * Update rules/aws_cloudtrail_rules/aws_s3_activity_greynoise.yml * Update rules/cloudflare_rules/cloudflare_firewall_suspicious_event_greynoise.yml * Update cloudflare_httpreq_bot_high_volume_greynoise.yml --------- Co-authored-by: Ariel Ropek <79653153+arielkr256@users.noreply.github.com> * fix - Notion Login From New Location - NoneType error (#1206) * fix - Notion Login From New Location - NoneType error * fix - Notion Login From New Location - NoneType error - linter fix * remove codeowners (#1208) * fix - GCP rules - AttributeError (#1210) * fix - GCP rules - AttributeError * fix - GCP rules - AttributeError - linter fix * MITRE ATT&CK Mappings for MS Rules (#1209) * added MITRE mappings for microsoft rules * fixed formatting on some helper files --------- Co-authored-by: Ariel Ropek <79653153+arielkr256@users.noreply.github.com> * traildiscover enrichment with managed schema (#1177) * traildiscover enrichment with managed schema * Add npm install in dockerfile (#1172) * add npm install in dockerfile * Remove Python optimizations; add prettier to PATH --------- Co-authored-by: egibs <keybase@egibs.xyz> * schema name: TrailDiscover.CloudTrail * Fix Dockerfile; add Workflow to test image * updated data set * Add MongoDB.2FA.Disabled rule (#1190) Co-authored-by: Ariel Ropek <79653153+arielkr256@users.noreply.github.com> * lint and fmt * fmt * add OCSF selector * additional OCSF mappings * Fix Pipfile * Rebase changes --------- Co-authored-by: Panos Sakkos <panos.sakkos@panther.com> Co-authored-by: egibs <keybase@egibs.xyz> Co-authored-by: Oleh Melenevskyi <767472+melenevskyi@users.noreply.github.com> * Update PAT to 0.46.0 (#1216) * THREAT-278 OCSF data model, VPC --------- Co-authored-by: Oleh Melenevskyi <767472+melenevskyi@users.noreply.github.com> Co-authored-by: Ariel Ropek <79653153+arielkr256@users.noreply.github.com> Co-authored-by: Panos Sakkos <panos.sakkos@panther.com> Co-authored-by: ben-githubs <38414634+ben-githubs@users.noreply.github.com> Co-authored-by: egibs <keybase@egibs.xyz> Co-authored-by: Evan Gibler <evan.gibler@panther.com> * fix: consider deny rules for ssh network acl policy (#1236) * fix: consider deny rules for ssh network acl policy * Update policies/aws_vpc_policies/aws_network_acl_restricted_ssh.py * Update policies/aws_vpc_policies/aws_network_acl_restricted_ssh.py --------- Co-authored-by: Ariel Ropek <79653153+arielkr256@users.noreply.github.com> * AWS Honeypot Detections threat-306 (#1252) * AWS Honeypot Detections threat-306 AWS Security Finding rules on decoy AWS resources: https://aws.amazon.com/blogs/security/how-to-detect-suspicious-activity-in-your-aws-account-by-using-private-decoy-resources/ * Update decoy_dynamodb_accessed.py * Update decoy_iam_assumed.py * Update decoy_s3_accessed.py * Update decoy_secret_accessed.py * Update decoy_systems_manager_parameter_accessed.py * Update decoy_dynamodb_accessed.py * Update decoy_iam_assumed.py * Update decoy_s3_accessed.py * Update decoy_secret_accessed.py * Update decoy_systems_manager_parameter_accessed.py * Update decoy_systems_manager_parameter_accessed.py * Update decoy_systems_manager_parameter_accessed.py * Update decoy_secret_accessed.py * Update decoy_s3_accessed.py * Update decoy_iam_assumed.py * Update decoy_dynamodb_accessed.py * Update decoy_systems_manager_parameter_accessed.py * reformatted and linted * removed unused methods * fixed trailing lines * add decoy rules as a pack --------- Co-authored-by: Ariel Ropek <79653153+arielkr256@users.noreply.github.com> --------- Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Evan Gibler <evan.gibler@panther.com> Co-authored-by: Ariel Ropek <79653153+arielkr256@users.noreply.github.com> Co-authored-by: Evan Gibler <20933572+egibs@users.noreply.github.com> Co-authored-by: Ariel Ropek <ariel.ropek@panther.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: BJ Maldonado <bj.maldonado-miranda@panther.com> Co-authored-by: akozlovets098 <95437895+akozlovets098@users.noreply.github.com> Co-authored-by: Oleh Melenevskyi <767472+melenevskyi@users.noreply.github.com> Co-authored-by: Panos Sakkos <panos.sakkos@panther.com> Co-authored-by: ben-githubs <38414634+ben-githubs@users.noreply.github.com> Co-authored-by: egibs <keybase@egibs.xyz> Co-authored-by: Eli Skeggs <1348991+skeggse@users.noreply.github.com>

…hout_mfa

* Update aws_console_login_without_mfa.py is_new_account has been checking with only recipientAccountId but our new aws account indicator creation rule has been checking for "new_account - recipientAccountId" * Update aws_console_login_without_mfa.py Casted str to account for NoneType * Update new_user_account_logging.py Added an alternative string in the case udm user is empty * Update new_user_account_logging.yml add mock test * Standard user creation fixes (#1256) * Prepare for `3.53.0` (#1232) * Replace panther_analysis_tool import with updated import (#1230) * Update Action versions; use SHAs (#1231) * Update Action versions; use SHAs * Add dependabot.yml to keep Actions updated * Update PAT to 0.49.0 * auth0-cic-credential-stuffing rule and query (#1246) * Add saved queries for ongoing Snowflake threats (#1248) * Add saved queries for ongoing Snowflake threats * Add limits Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> * snowflake pack * Add scheduled queries and rules Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> * pack update * ruleID fix * make fmt Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> * Fix merge conflicts Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> * Turn off by default Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> --------- Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> Co-authored-by: Ariel Ropek <ariel.ropek@panther.com> * Update panther-core to 0.10.1 via PAT (#1249) Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> * Tweak Snowflake queries (#1250) * Tweak Snowflake queries Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> * Remove configuration drift query from Pack Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> * Threat Hunting queries are okay Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> * Fix comment Workflow Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> * 12 hours -> 1 day Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> * Update queries/snowflake_queries/snowflake_0108977_configuration_drift.yml --------- Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> Co-authored-by: Ariel Ropek <79653153+arielkr256@users.noreply.github.com> * Fixed typo in README.md (#1253) fixed 'unintall' typo to 'npm uninstall prettier' * build(deps): bump step-security/harden-runner from 2.8.0 to 2.8.1 (#1254) Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.8.0 to 2.8.1. - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@f086349...17d0e2b) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Using GITHUB_OUTPUT env var instead of old ::set-output shorthand (#1255) * OCSF data model, VPC/DNS (#1214) * Deprecate GreyNoise detections (#1205) * Deprecate GreyNoise detections * Update rules/aws_cloudtrail_rules/aws_s3_activity_greynoise.yml * Update rules/cloudflare_rules/cloudflare_firewall_suspicious_event_greynoise.yml * Update cloudflare_httpreq_bot_high_volume_greynoise.yml --------- Co-authored-by: Ariel Ropek <79653153+arielkr256@users.noreply.github.com> * fix - Notion Login From New Location - NoneType error (#1206) * fix - Notion Login From New Location - NoneType error * fix - Notion Login From New Location - NoneType error - linter fix * remove codeowners (#1208) * fix - GCP rules - AttributeError (#1210) * fix - GCP rules - AttributeError * fix - GCP rules - AttributeError - linter fix * MITRE ATT&CK Mappings for MS Rules (#1209) * added MITRE mappings for microsoft rules * fixed formatting on some helper files --------- Co-authored-by: Ariel Ropek <79653153+arielkr256@users.noreply.github.com> * traildiscover enrichment with managed schema (#1177) * traildiscover enrichment with managed schema * Add npm install in dockerfile (#1172) * add npm install in dockerfile * Remove Python optimizations; add prettier to PATH --------- Co-authored-by: egibs <keybase@egibs.xyz> * schema name: TrailDiscover.CloudTrail * Fix Dockerfile; add Workflow to test image * updated data set * Add MongoDB.2FA.Disabled rule (#1190) Co-authored-by: Ariel Ropek <79653153+arielkr256@users.noreply.github.com> * lint and fmt * fmt * add OCSF selector * additional OCSF mappings * Fix Pipfile * Rebase changes --------- Co-authored-by: Panos Sakkos <panos.sakkos@panther.com> Co-authored-by: egibs <keybase@egibs.xyz> Co-authored-by: Oleh Melenevskyi <767472+melenevskyi@users.noreply.github.com> * Update PAT to 0.46.0 (#1216) * THREAT-278 OCSF data model, VPC --------- Co-authored-by: Oleh Melenevskyi <767472+melenevskyi@users.noreply.github.com> Co-authored-by: Ariel Ropek <79653153+arielkr256@users.noreply.github.com> Co-authored-by: Panos Sakkos <panos.sakkos@panther.com> Co-authored-by: ben-githubs <38414634+ben-githubs@users.noreply.github.com> Co-authored-by: egibs <keybase@egibs.xyz> Co-authored-by: Evan Gibler <evan.gibler@panther.com> * fix: consider deny rules for ssh network acl policy (#1236) * fix: consider deny rules for ssh network acl policy * Update policies/aws_vpc_policies/aws_network_acl_restricted_ssh.py * Update policies/aws_vpc_policies/aws_network_acl_restricted_ssh.py --------- Co-authored-by: Ariel Ropek <79653153+arielkr256@users.noreply.github.com> * AWS Honeypot Detections threat-306 (#1252) * AWS Honeypot Detections threat-306 AWS Security Finding rules on decoy AWS resources: https://aws.amazon.com/blogs/security/how-to-detect-suspicious-activity-in-your-aws-account-by-using-private-decoy-resources/ * Update decoy_dynamodb_accessed.py * Update decoy_iam_assumed.py * Update decoy_s3_accessed.py * Update decoy_secret_accessed.py * Update decoy_systems_manager_parameter_accessed.py * Update decoy_dynamodb_accessed.py * Update decoy_iam_assumed.py * Update decoy_s3_accessed.py * Update decoy_secret_accessed.py * Update decoy_systems_manager_parameter_accessed.py * Update decoy_systems_manager_parameter_accessed.py * Update decoy_systems_manager_parameter_accessed.py * Update decoy_secret_accessed.py * Update decoy_s3_accessed.py * Update decoy_iam_assumed.py * Update decoy_dynamodb_accessed.py * Update decoy_systems_manager_parameter_accessed.py * reformatted and linted * removed unused methods * fixed trailing lines * add decoy rules as a pack --------- Co-authored-by: Ariel Ropek <79653153+arielkr256@users.noreply.github.com> --------- Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Evan Gibler <evan.gibler@panther.com> Co-authored-by: Ariel Ropek <79653153+arielkr256@users.noreply.github.com> Co-authored-by: Evan Gibler <20933572+egibs@users.noreply.github.com> Co-authored-by: Ariel Ropek <ariel.ropek@panther.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: BJ Maldonado <bj.maldonado-miranda@panther.com> Co-authored-by: akozlovets098 <95437895+akozlovets098@users.noreply.github.com> Co-authored-by: Oleh Melenevskyi <767472+melenevskyi@users.noreply.github.com> Co-authored-by: Panos Sakkos <panos.sakkos@panther.com> Co-authored-by: ben-githubs <38414634+ben-githubs@users.noreply.github.com> Co-authored-by: egibs <keybase@egibs.xyz> Co-authored-by: Eli Skeggs <1348991+skeggse@users.noreply.github.com> --------- Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Evan Gibler <evan.gibler@panther.com> Co-authored-by: Ariel Ropek <79653153+arielkr256@users.noreply.github.com> Co-authored-by: Evan Gibler <20933572+egibs@users.noreply.github.com> Co-authored-by: Ariel Ropek <ariel.ropek@panther.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: BJ Maldonado <bj.maldonado-miranda@panther.com> Co-authored-by: akozlovets098 <95437895+akozlovets098@users.noreply.github.com> Co-authored-by: Oleh Melenevskyi <767472+melenevskyi@users.noreply.github.com> Co-authored-by: Panos Sakkos <panos.sakkos@panther.com> Co-authored-by: ben-githubs <38414634+ben-githubs@users.noreply.github.com> Co-authored-by: egibs <keybase@egibs.xyz> Co-authored-by: Eli Skeggs <1348991+skeggse@users.noreply.github.com>

Update aws_console_login_without_mfa.py

e4bf570

is_new_account has been checking with only recipientAccountId but our new aws account indicator creation rule has been checking for "new_account - recipientAccountId"

JPhenglavong requested a review from a team as a code owner May 13, 2024 13:35

egibs reviewed May 13, 2024

View reviewed changes

Comment thread rules/aws_cloudtrail_rules/aws_console_login_without_mfa.py

Update aws_console_login_without_mfa.py

9f9fee2

Casted str to account for NoneType

JPhenglavong commented May 14, 2024

View reviewed changes

JPhenglavong added 2 commits May 14, 2024 16:53

Merge branch 'release' into JPhenglavong-update-aws_console_login_wit…

13be664

…hout_mfa

Update new_user_account_logging.py

4616f35

Added an alternative string in the case udm user is empty

JPhenglavong added 2 commits May 30, 2024 08:31

Merge branch 'release' into JPhenglavong-update-aws_console_login_wit…

743ede9

…hout_mfa

Update new_user_account_logging.yml

72f363c

add mock test

JPhenglavong and others added 2 commits June 10, 2024 10:38

Merge branch 'release' into JPhenglavong-update-aws_console_login_wit…

e808045

…hout_mfa

arielkr256 approved these changes Jun 10, 2024

View reviewed changes

arielkr256 merged commit a15c5e6 into release Jun 10, 2024

arielkr256 deleted the JPhenglavong-update-aws_console_login_without_mfa branch June 10, 2024 18:41

arielkr256 mentioned this pull request Sep 25, 2024

check_account_age key incorrect for AWS accounts #494

Closed

Navigation Menu

Update aws_console_login_without_mfa.py - #1237

Update aws_console_login_without_mfa.py#1237
arielkr256 merged 8 commits into
releasefrom
JPhenglavong-update-aws_console_login_without_mfa

JPhenglavong commented May 13, 2024

Uh oh!

JPhenglavong left a comment

JPhenglavong commented May 15, 2024 •

edited

Loading

github-actions Bot commented Jun 10, 2024

Labels

3 participants

Conversation

JPhenglavong commented May 13, 2024

Background

Changes

Testing

Uh oh!

JPhenglavong left a comment

Choose a reason for hiding this comment

JPhenglavong commented May 15, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

github-actions Bot commented Jun 10, 2024

Labels

3 participants

JPhenglavong commented May 15, 2024 •

edited

Loading