PowerShellでAWS CloudTrailログを分析し、不審操作を効率的に検出する方法

{
  "eventVersion": "1.08",
  "userIdentity": {
    "type": "IAMUser",
    "userName": "example-user",
    "arn": "arn:aws:iam::123456789012:user/example-user"
  },
  "eventTime": "2023-12-31T12:34:56Z",
  "eventName": "RunInstances",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "203.0.113.0",
  "eventSource": "ec2.amazonaws.com",
  "requestParameters": { ... },
  "responseElements": { ... }
}

Install-Module -Name AWSPowerShell -Force -AllowClobber

Import-Module AWSPowerShell

Set-AWSCredential -AccessKey "your-access-key" -SecretKey "your-secret-key" -Region "us-east-1"

# 直近1日のログを取得
$startTime = (Get-Date).AddDays(-1)
$endTime = Get-Date

Get-CloudTrailEvent -StartTime $startTime -EndTime $endTime | Export-Csv -Path "CloudTrailLogs.csv" -NoTypeInformation

Get-CloudTrailEvent -StartTime $startTime -EndTime $endTime |
Where-Object { $_.EventSource -eq "ec2.amazonaws.com" } |
Export-Csv -Path "EC2Events.csv" -NoTypeInformation

# スクリプト例
$startTime = (Get-Date).AddDays(-1)
$endTime = Get-Date
$outputPath = "C:\Logs\CloudTrailLogs_$(Get-Date -Format yyyyMMdd).csv"

Get-CloudTrailEvent -StartTime $startTime -EndTime $endTime |
Export-Csv -Path $outputPath -NoTypeInformation

{
  "eventVersion": "1.08",
  "userIdentity": {
    "type": "IAMUser",
    "userName": "example-user",
    "arn": "arn:aws:iam::123456789012:user/example-user",
    "principalId": "EXAMPLEPRINCIPALID"
  },
  "eventTime": "2023-12-31T12:34:56Z",
  "eventSource": "ec2.amazonaws.com",
  "eventName": "RunInstances",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "203.0.113.0",
  "userAgent": "aws-cli/2.4.7 Python/3.8.8",
  "requestParameters": { ... },
  "responseElements": { ... },
  "eventID": "b4c3f91e-6789-4321-b9dc-abcdef123456",
  "eventType": "AwsApiCall"
}

# JSONログファイルの読み込み
$jsonLogs = Get-Content -Path "CloudTrailLog.json" | ConvertFrom-Json

# 各エントリの解析
foreach ($log in $jsonLogs) {
    Write-Output "Event Name: $($log.eventName)"
    Write-Output "User: $($log.userIdentity.userName)"
    Write-Output "Source IP: $($log.sourceIPAddress)"
    Write-Output "Event Time: $($log.eventTime)"
}

   $suspiciousIPs = $jsonLogs | Where-Object { $_.sourceIPAddress -notlike "192.168.*" }
   $suspiciousIPs | ForEach-Object { Write-Output "Suspicious IP: $($_.sourceIPAddress)" }

   $ec2Actions = $jsonLogs | Where-Object { $_.eventSource -eq "ec2.amazonaws.com" -and $_.eventName -in @("RunInstances", "TerminateInstances") }
   $ec2Actions | ForEach-Object { Write-Output "Event: $($_.eventName) by $($_.userIdentity.userName)" }

# 1. AWS認証情報の設定
Set-AWSCredential -AccessKey "your-access-key" -SecretKey "your-secret-key" -Region "us-east-1"

# 2. CloudTrailログの取得
$startTime = (Get-Date).AddDays(-1)
$endTime = Get-Date
$logs = Get-CloudTrailEvent -StartTime $startTime -EndTime $endTime

# 3. ログの解析
foreach ($log in $logs) {
    Write-Output "Event: $($log.eventName)"
    Write-Output "User: $($log.userIdentity.userName)"
    Write-Output "Source IP: $($log.sourceIPAddress)"
    Write-Output "Event Time: $($log.eventTime)"
    Write-Output "---"
}

# 外部IPアドレスの検出
$suspiciousLogs = $logs | Where-Object { $_.sourceIPAddress -notlike "192.168.*" }

foreach ($log in $suspiciousLogs) {
    Write-Output "Suspicious IP Detected: $($log.sourceIPAddress)"
    Write-Output "User: $($log.userIdentity.userName)"
    Write-Output "Event: $($log.eventName)"
    Write-Output "---"
}

# EC2操作の監視
$ec2Actions = $logs | Where-Object { $_.eventSource -eq "ec2.amazonaws.com" -and $_.eventName -in @("RunInstances", "TerminateInstances") }

foreach ($log in $ec2Actions) {
    Write-Output "EC2 Action: $($log.eventName)"
    Write-Output "User: $($log.userIdentity.userName)"
    Write-Output "Time: $($log.eventTime)"
    Write-Output "---"
}

# レポートの保存
$outputPath = "C:\Logs\CloudTrailReport_$(Get-Date -Format yyyyMMdd).csv"
$filteredLogs = $logs | Where-Object { $_.sourceIPAddress -notlike "192.168.*" }

$filteredLogs | Select-Object eventName, userIdentity.userName, sourceIPAddress, eventTime |
Export-Csv -Path $outputPath -NoTypeInformation

Write-Output "Report saved to $outputPath"

powershell.exe -File "C:\Scripts\AnalyzeCloudTrail.ps1"

# 社内ネットワークの範囲を定義
$internalIPRange = "192.168.*"

# 社内外のアクセスを区別
$suspiciousIPs = $logs | Where-Object { $_.sourceIPAddress -notlike $internalIPRange }

foreach ($log in $suspiciousIPs) {
    Write-Output "Suspicious Access Detected:"
    Write-Output "IP: $($log.sourceIPAddress)"
    Write-Output "User: $($log.userIdentity.userName)"
    Write-Output "Action: $($log.eventName)"
    Write-Output "Time: $($log.eventTime)"
    Write-Output "---"
}

# APIコール頻度を計算
$frequentActions = $logs | Group-Object -Property userIdentity.userName | Where-Object { $_.Count -gt 50 }

foreach ($action in $frequentActions) {
    Write-Output "High Frequency API Calls Detected:"
    Write-Output "User: $($action.Name)"
    Write-Output "API Calls: $($action.Count)"
    Write-Output "---"
}

# 深夜の時間帯を定義 (午後11時から午前5時)
$offHours = (23..24) + (0..5)

# 操作時間を解析
$offHoursLogs = $logs | Where-Object {
    $hour = (Get-Date $_.eventTime).Hour
    $hour -in $offHours
}

foreach ($log in $offHoursLogs) {
    Write-Output "Off-Hours Activity Detected:"
    Write-Output "User: $($log.userIdentity.userName)"
    Write-Output "Action: $($log.eventName)"
    Write-Output "Time: $($log.eventTime)"
    Write-Output "---"
}

# 重要アクションを定義
$criticalActions = @("DeleteUser", "CreateRole", "AttachRolePolicy", "TerminateInstances")

# 高権限アクションを検出
$criticalLogs = $logs | Where-Object { $_.eventName -in $criticalActions }

foreach ($log in $criticalLogs) {
    Write-Output "Critical Action Detected:"
    Write-Output "Action: $($log.eventName)"
    Write-Output "User: $($log.userIdentity.userName)"
    Write-Output "Time: $($log.eventTime)"
    Write-Output "---"
}

# メール通知の例
Send-MailMessage -From "alerts@example.com" -To "admin@example.com" -Subject "Suspicious Activity Detected" -Body "Details of the suspicious activity are attached." -SmtpServer "smtp.example.com"