Detection: AWS Create Policy Version to allow all resources

Description

The following analytic identifies the creation of a new AWS IAM policy version that allows access to all resources. It detects this activity by analyzing AWS CloudTrail logs for the CreatePolicyVersion event with a policy document that grants broad permissions. This behavior is significant because it violates the principle of least privilege, potentially exposing the environment to misuse or abuse. If confirmed malicious, an attacker could gain extensive access to AWS resources, leading to unauthorized actions, data exfiltration, or further compromise of the AWS environment.

Search

1`cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws.com errorCode = success 
2| spath input=requestParameters.policyDocument output=key_policy_statements path=Statement{} 
3| mvexpand key_policy_statements 
4| spath input=key_policy_statements output=key_policy_action_1 path=Action 
5| where key_policy_action_1 = "*" 
6| stats count min(_time) as firstTime max(_time) as lastTime values(key_policy_statements) as policy_added by eventName eventSource aws_account_id errorCode userAgent eventID awsRegion user user_arn 
7| `security_content_ctime(firstTime)` 
8| `security_content_ctime(lastTime)`
9|`aws_create_policy_version_to_allow_all_resources_filter`

Data Source

Name	Platform	Sourcetype	Source	Supported App
AWS CloudTrail CreatePolicyVersion	AWS	'aws:cloudtrail'	'aws_cloudtrail'	N/A

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.

Known False Positives

While this search has no known false positives, it is possible that an AWS admin has legitimately created a policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources and you must verify this activity.

Associated Analytic Story

• AWS IAM Privilege Escalation

Risk Based Analytics (RBA)

References

• https://bishopfox.com/blog/privilege-escalation-in-aws

• https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 5