:warning: THIS IS A EXPERIMENTAL DETECTION

This detection has been marked experimental by the Splunk Threat Research team. This means we have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is NOT supported.

Try in Splunk Security Cloud

Description

The following detection identifes when a policy is deleted on AWS. This does not identify whether successful or failed, but the error messages tell a story of suspicious attempts. There is a specific process to follow when deleting a policy. First, detach the policy from all users, groups, and roles that the policy is attached to, using DetachUserPolicy , DetachGroupPolicy , or DetachRolePolicy.

  • Type: Hunting

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud

  • Last Updated: 2023-06-02
  • Author: Patrick Bareiss, Splunk
  • ID: 609ced68-d420-4ff7-8164-ae98b4b4018c

Annotations

ATT&CK

ATT&CK

ID Technique Tactic
T1098 Account Manipulation Persistence, Privilege Escalation
Kill Chain Phase
  • Installation
  • Exploitation
NIST
  • DE.AE
CIS20
  • CIS 10
CVE 


1
2
3
4
5



`amazon_security_lake` api.operation=DeletePolicy 
| stats count min(_time) as firstTime max(_time) as lastTime by api.operation api.service.name identity.user.account_uid identity.user.credential_uid identity.user.name identity.user.type identity.user.uid identity.user.uuid http_request.user_agent src_endpoint.ip cloud.region 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `asl_aws_iam_delete_policy_filter`

Macros

The SPL above uses the following Macros:

:information_source: asl_aws_iam_delete_policy_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

  • api.service.name
  • api.operation
  • identity.user.account_uid
  • identity.user.credential_uid
  • identity.user.name
  • identity.user.type
  • identity.user.uid
  • identity.user.uuid
  • http_request.user_agent
  • src_endpoint.ip

How To Implement

You must install Splunk Add-On for AWS Version v7.0.0 (https://splunkbase.splunk.com/app/1876) that includes includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. This search works with Amazon Security Lake logs which are parsed in the Open Cybersecurity Schema Framework (OCSF)format.

Known False Positives

This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete policies (least privilege). In addition, this may be saved seperately and tuned for failed or success attempts only.

Associated Analytic Story

RBA

Risk Score Impact Confidence Message
10.0 20 50 User $user_arn$ has deleted AWS Policies from IP address $src$ by executing the following command $eventName$

:information_source: The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1