:warning: THIS IS A EXPERIMENTAL DETECTION

This detection has been marked experimental by the Splunk Threat Research team. This means we have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is NOT supported.

Try in Splunk Security Cloud

Description

The following analytic identifies a user attaching a policy to a different role's trust policy in AWS. It leverages CloudWatch logs to detect the attach policy event, extracting relevant fields such as policyArn, sourceIPAddress, and userIdentity. This activity is significant as it can indicate attempts at lateral movement or privilege escalation within the AWS environment. If confirmed malicious, an attacker could gain elevated permissions, potentially compromising sensitive resources and data within the AWS infrastructure.

  • Type: Hunting

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud

  • Last Updated: 2024-05-12
  • Author: Rod Soto, Splunk
  • ID: 88fc31dd-f331-448c-9856-d3d51dd5d3a1

Annotations

ATT&CK

ATT&CK

ID Technique Tactic
T1078 Valid Accounts Defense Evasion, Persistence, Privilege Escalation, Initial Access
Kill Chain Phase
  • Exploitation
  • Installation
  • Delivery
NIST
  • DE.AE
CIS20
  • CIS 10
CVE 


1
2
3
4



`aws_cloudwatchlogs_eks` attach policy
| spath requestParameters.policyArn 
| table sourceIPAddress user_access_key userIdentity.arn userIdentity.sessionContext.sessionIssuer.arn eventName errorCode errorMessage status action requestParameters.policyArn userIdentity.sessionContext.attributes.mfaAuthenticated userIdentity.sessionContext.attributes.creationDate  
| `aws_detect_attach_to_role_policy_filter`

Macros

The SPL above uses the following Macros:

:information_source: aws_detect_attach_to_role_policy_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

  • _time
  • requestParameters.policyArn

How To Implement

You must install splunk AWS add-on and Splunk App for AWS. This search works with cloudwatch logs

Known False Positives

Attach to policy can create a lot of noise. This search can be adjusted to provide specific values to identify cases of abuse (i.e status=failure). The search can provide context for common users attaching themselves to higher privilege policies or even newly created policies.

Associated Analytic Story

RBA

Risk Score Impact Confidence Message
25.0 50 50 tbd

:information_source: The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 2