Detection: ASL AWS Create Policy Version to allow all resources

Description

The following analytic identifies the creation of a new AWS IAM policy version that allows access to all resources. It detects this activity by analyzing AWS CloudTrail logs for the CreatePolicyVersion event with a policy document that grants broad permissions. This behavior is significant because it violates the principle of least privilege, potentially exposing the environment to misuse or abuse. If confirmed malicious, an attacker could gain extensive access to AWS resources, leading to unauthorized actions, data exfiltration, or further compromise of the AWS environment.

Search

 1`amazon_security_lake` api.operation=CreatePolicy 
 2| spath input=api.request.data 
 3| spath input=policyDocument 
 4| regex Statement{}.Action="\*" 
 5| regex Statement{}.Resource="\*" 
 6| fillnull 
 7| stats count min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.uid actor.user.account.uid http_request.user_agent src_endpoint.ip cloud.region api.request.data 
 8| rename actor.user.uid as user, src_endpoint.ip as src_ip, cloud.region as region, http_request.user_agent as user_agent 
 9| `security_content_ctime(firstTime)` 
10| `security_content_ctime(lastTime)`
11|`asl_aws_create_policy_version_to_allow_all_resources_filter`

Data Source

Name	Platform	Sourcetype	Source
ASL AWS CloudTrail	AWS	'aws:asl'	'aws_asl'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.

Known False Positives

While this search has no known false positives, it is possible that an AWS admin has legitimately created a policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources and you must verify this activity.

Associated Analytic Story

• AWS IAM Privilege Escalation

Risk Based Analytics (RBA)

Risk Message:

User $user$ created a policy version that allows them to access any resource in their account

References

• https://bishopfox.com/blog/privilege-escalation-in-aws

• https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1