name: aws detect sts assume role abuse
id: 8e565314-b6a2-46d8-9f05-1a34a176a662
version: 1
date: '2020-07-27'
author: Rod Soto, Splunk
type: batch
datamodel: []
description: This search provides detection of suspicious use of sts:AssumeRole. These
  tokens can be created on the go and used by attackers to move laterally and escalate
  privileges.
search: '`cloudtrail` user_type=AssumedRole userIdentity.sessionContext.sessionIssuer.type=Role
  | table sourceIPAddress userIdentity.arn user_agent user_access_key status action
  requestParameters.roleName responseElements.role.roleName responseElements.role.createDate
  | `aws_detect_sts_assume_role_abuse_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
  search works with cloudtrail logs
known_false_positives: Sts:AssumeRole can be very noisy as it is a standard mechanism
  to provide cross account and cross resources access. This search can be adjusted
  to provide specific values to identify cases of abuse.
references: []
tags:
  analytic_story:
  - AWS Cross Account Activity
  asset_type: AWS Account
  kill_chain_phases:
  - Lateral Movement
  mitre_attack_id:
  - T1078
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - user_type
  - userIdentity.sessionContext.sessionIssuer.type
  - sourceIPAddress
  - userIdentity.arn
  - user_agent
  - user_access_key
  - status
  - action
  - requestParameters.roleName
  - esponseElements.role.roleName
  - esponseElements.role.createDate
  security_domain: threat
