new_rules

[saakovv]

Summary of the Pull Request

The ImportKeyPair action in the context of Amazon Web Services (AWS) is used to import a public SSH key into your AWS account. This allows you to use an existing SSH key to access your EC2 instances.

If an attacker gains access to this function, they can: • Import their own key: This would allow them to gain SSH access to instances associated with that key. • Gain unauthorized access: Use the imported key to execute commands on the instances, potentially accessing sensitive data or disrupting services.

Changelog

Example Log Event

 awsCloud_account_ID: 123
   awsRegion: eu-central
   cwlGroupname: aws-controltower/CloudTrailLogs
   eventCategory: Management
   eventID: 123
   eventName: ImportKeyPair
   eventSource: ec2.amazonaws.com
   eventTime: 2024-09-12T08:00:33Z
   eventType: AwsApiCall
   eventVersion: 1.10
   managementEvent: true
   readOnly: false
   recipientAccountId: 123
   requestID: 123
   requestParameters: { 
   }
   responseElements: { 
   }
   sessionCredentialFromConsole: true
   sourceIPAddress: XXX
   tlsDetails: {
   }
   userAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
   userIdentity: { 

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions