ID | Technique | Tactic |
---|---|---|
T1078.004 | Cloud Accounts | Defense Evasion |
Detection: AWS Create Policy Version to allow all resources
Description
The following analytic identifies the creation of a new AWS IAM policy version that allows access to all resources. It detects this activity by analyzing AWS CloudTrail logs for the CreatePolicyVersion event with a policy document that grants broad permissions. This behavior is significant because it violates the principle of least privilege, potentially exposing the environment to misuse or abuse. If confirmed malicious, an attacker could gain extensive access to AWS resources, leading to unauthorized actions, data exfiltration, or further compromise of the AWS environment.
Search
1`cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws.com errorCode = success
2| spath input=requestParameters.policyDocument output=key_policy_statements path=Statement{}
3| mvexpand key_policy_statements
4| spath input=key_policy_statements output=key_policy_action_1 path=Action
5| where key_policy_action_1 = "*"
6| rename user_name as user
7| stats count min(_time) as firstTime max(_time) as lastTime values(key_policy_statements) as policy_added by signature dest user user_agent src vendor_account vendor_region vendor_product
8| `security_content_ctime(firstTime)`
9| `security_content_ctime(lastTime)`
10|`aws_create_policy_version_to_allow_all_resources_filter`
Data Source
Name | Platform | Sourcetype | Source |
---|---|---|---|
AWS CloudTrail CreatePolicyVersion | 'aws:cloudtrail' |
'aws_cloudtrail' |
Macros Used
Name | Value |
---|---|
cloudtrail | sourcetype=aws:cloudtrail |
aws_create_policy_version_to_allow_all_resources_filter | search * |
aws_create_policy_version_to_allow_all_resources_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Notable | Yes |
Rule Title | %name% |
Rule Description | %description% |
Notable Event Fields | user, dest |
Creates Risk Event | True |
Implementation
You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
Known False Positives
While this search has no known false positives, it is possible that an AWS admin has legitimately created a policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources and you must verify this activity.
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message:
User $user$ created a policy version that allows them to access any resource in their account.
Risk Object | Risk Object Type | Risk Score | Threat Objects |
---|---|---|---|
user | user | 49 | No Threat Objects |
References
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | aws_cloudtrail |
aws:cloudtrail |
Integration | ✅ Passing | Dataset | aws_cloudtrail |
aws:cloudtrail |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 9