AWSCloudTrail - Successful API executed from a Tor exit node

Back


Id	0adab960-5565-4978-ba6d-044553e4acc4
Rulename	AWSCloudTrail - Successful API executed from a Tor exit node
Description	Identifies successful AWS CloudTrail API activity originating from an IP address identified as a TOR exit node in the external TOR list hosted at https://firewalliplists.gypthecat.com/lists/kusto/kusto-tor-exit.csv.zip. The rule alerts only when CloudTrail indicates the request completed successfully with no ErrorCode and no ErrorMessage, and the source IP is present in the TOR exit node list.
Severity	High
Tactics	Execution
Techniques	T1204
Required data connectors	AWS
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Amazon Web Services/Analytic Rules/AWS_APIfromTor.yaml
Version	1.0.2
Arm template	0adab960-5565-4978-ba6d-044553e4acc4.json

KQL

let TorNodes = (
externaldata (TorIP:string)
[h@'https://firewalliplists.gypthecat.com/lists/kusto/kusto-tor-exit.csv.zip']
with (ignoreFirstRecord=true));
AWSCloudTrail
| where SourceIpAddress in (TorNodes) and isempty(ErrorCode) and isempty(ErrorMessage)
| extend UserIdentityArn = iif(isempty(UserIdentityArn), tostring(parse_json(Resources)[0].ARN), UserIdentityArn)
| extend UserName = tostring(split(UserIdentityArn, '/')[-1])
| extend AccountName = case( UserIdentityPrincipalid == "Anonymous", "Anonymous", isempty(UserIdentityUserName), UserName, UserIdentityUserName)
| extend AccountName = iif(AccountName contains "@", tostring(split(AccountName, '@', 0)[0]), AccountName),
    AccountUPNSuffix = iif(AccountName contains "@", tostring(split(AccountName, '@', 1)[0]), "")
| project TimeGenerated, SourceIpAddress, AccountName, AccountUPNSuffix, UserIdentityArn, UserIdentityUserName, UserIdentityPrincipalid, EventName, EventSource, AWSRegion, RecipientAccountId

YAML

entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountName
  - identifier: UPNSuffix
    columnName: AccountUPNSuffix
  - identifier: CloudAppAccountId
    columnName: RecipientAccountId
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SourceIpAddress
tactics:
- Execution
requiredDataConnectors:
- dataTypes:
  - AWSCloudTrail
  connectorId: AWS
alertDetailsOverride:
  alertDisplayNameFormat: 'Successful AWS API call from TOR exit node: {{AccountName}} from {{SourceIpAddress}}'
  alertDescriptionFormat: A successful AWS API call was observed from TOR exit node IP {{SourceIpAddress}} for account {{AccountName}}.
id: 0adab960-5565-4978-ba6d-044553e4acc4
severity: High
status: Available
customDetails:
  AWSRegion: AWSRegion
  UserIdentityArn: UserIdentityArn
  EventSource: EventSource
  EventName: EventName
query: |
  let TorNodes = (
  externaldata (TorIP:string)
  [h@'https://firewalliplists.gypthecat.com/lists/kusto/kusto-tor-exit.csv.zip']
  with (ignoreFirstRecord=true));
  AWSCloudTrail
  | where SourceIpAddress in (TorNodes) and isempty(ErrorCode) and isempty(ErrorMessage)
  | extend UserIdentityArn = iif(isempty(UserIdentityArn), tostring(parse_json(Resources)[0].ARN), UserIdentityArn)
  | extend UserName = tostring(split(UserIdentityArn, '/')[-1])
  | extend AccountName = case( UserIdentityPrincipalid == "Anonymous", "Anonymous", isempty(UserIdentityUserName), UserName, UserIdentityUserName)
  | extend AccountName = iif(AccountName contains "@", tostring(split(AccountName, '@', 0)[0]), AccountName),
      AccountUPNSuffix = iif(AccountName contains "@", tostring(split(AccountName, '@', 1)[0]), "")
  | project TimeGenerated, SourceIpAddress, AccountName, AccountUPNSuffix, UserIdentityArn, UserIdentityUserName, UserIdentityPrincipalid, EventName, EventSource, AWSRegion, RecipientAccountId  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Amazon Web Services/Analytic Rules/AWS_APIfromTor.yaml
kind: Scheduled
queryPeriod: 1d
version: 1.0.2
name: AWSCloudTrail - Successful API executed from a Tor exit node
queryFrequency: 1d
triggerThreshold: 0
relevantTechniques:
- T1204
description: |
  Identifies successful AWS CloudTrail API activity originating from an IP address identified as a TOR exit node in
  the external TOR list hosted at https://firewalliplists.gypthecat.com/lists/kusto/kusto-tor-exit.csv.zip. The rule alerts
  only when CloudTrail indicates the request completed successfully with no ErrorCode and no ErrorMessage, and the source
  IP is present in the TOR exit node list.  
triggerOperator: gt

ARM