ID | Technique | Tactic |
---|---|---|
T1078.004 | Cloud Accounts | Defense Evasion |
T1078 | Valid Accounts | Initial Access |
Detection: AWS Create Policy Version to allow all resources
Description
The following analytic identifies the creation of a new AWS IAM policy version that allows access to all resources. It detects this activity by analyzing AWS CloudTrail logs for the CreatePolicyVersion event with a policy document that grants broad permissions. This behavior is significant because it violates the principle of least privilege, potentially exposing the environment to misuse or abuse. If confirmed malicious, an attacker could gain extensive access to AWS resources, leading to unauthorized actions, data exfiltration, or further compromise of the AWS environment.
Search
1`cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws.com errorCode = success
2| spath input=requestParameters.policyDocument output=key_policy_statements path=Statement{}
3| mvexpand key_policy_statements
4| spath input=key_policy_statements output=key_policy_action_1 path=Action
5| where key_policy_action_1 = "*"
6| stats count min(_time) as firstTime max(_time) as lastTime values(key_policy_statements) as policy_added by eventName eventSource aws_account_id errorCode userAgent eventID awsRegion user user_arn
7| `security_content_ctime(firstTime)`
8| `security_content_ctime(lastTime)`
9|`aws_create_policy_version_to_allow_all_resources_filter`
Data Source
Name | Platform | Sourcetype | Source | Supported App |
---|---|---|---|---|
AWS CloudTrail CreatePolicyVersion | AWS | 'aws:cloudtrail' |
'aws_cloudtrail' |
N/A |
Macros Used
Name | Value |
---|---|
cloudtrail | sourcetype=aws:cloudtrail |
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Notable | Yes |
Rule Title | %name% |
Rule Description | %description% |
Notable Event Fields | user, dest |
Creates Risk Event | True |
Implementation
You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
Known False Positives
While this search has no known false positives, it is possible that an AWS admin has legitimately created a policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources and you must verify this activity.
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message | Risk Score | Impact | Confidence |
---|---|---|---|
User $user$ created a policy version that allows them to access any resource in their account. | 49 | 70 | 70 |
References
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | aws_cloudtrail |
aws:cloudtrail |
Integration | ✅ Passing | Dataset | aws_cloudtrail |
aws:cloudtrail |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 5