admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inAWS IAM Assume Role Policy Brute Force

Browse Source
This commit is contained in:
root
2021-04-15 19:17:21 +00:00
parent d6a32d4bd5
commit f07a6cd445
1 changed files with 19 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/aws_iam_assume_role_policy_brute_force.yml
+19 -11
View File
@@ -5,22 +5,29 @@ date: '2021-04-01'
author: Michael Haag, Splunk
type: batch
datamodel: []
description: The following detection identifies any malformed policy document exceptions with a status of `failure`. Meaning, when an adversary is attempting to identify a role name, multiple failures will occur.
search: '`cloudtrail` (errorCode=MalformedPolicyDocumentException) status=failure (userAgent!=*.amazonaws.com)
| stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyName) as policy_name by src eventName eventSource aws_account_id errorCode requestParameters.policyDocument userAgent eventID awsRegion userIdentity.principalId user_arn
| where count >= 2
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `aws_iam_assume_role_policy_brute_force_filter`'
how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. Set the `where count` greater than a value to identify suspicious activity in your environment.
known_false_positives: This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users.
description: The following detection identifies any malformed policy document exceptions
with a status of `failure`. Meaning, when an adversary is attempting to identify
a role name, multiple failures will occur.
search: '`cloudtrail` (errorCode=MalformedPolicyDocumentException) status=failure
(userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as
lastTime values(requestParameters.policyName) as policy_name by src eventName eventSource
aws_account_id errorCode requestParameters.policyDocument userAgent eventID awsRegion
userIdentity.principalId user_arn | where count >= 2 | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `aws_iam_assume_role_policy_brute_force_filter`'
how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
this data. The search requires AWS Cloudtrail logs. Set the `where count` greater
than a value to identify suspicious activity in your environment.
known_false_positives: This detection will require tuning to provide high fidelity
detection capabilties. Tune based on src addresses (corporate offices, VPN terminations)
or by groups of users.
references:
- https://www.praetorian.com/blog/aws-iam-assume-role-vulnerabilities
- https://www.elastic.co/guide/en/security/current/aws-iam-brute-force-of-assume-role-policy.html
tags:
analytic_story:
- AWS IAM Privilege Escalation
dataset: []
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_assume_role_policy_brute_force/aws_iam_assume_role_policy_brute_force.json
kill_chain_phases:
- Privilege Escalation
mitre_attack_id:
@@ -37,4 +44,5 @@ tags:
- userAgent
- errorCode
- requestParameters.policyName
security_domain: access
security_domain: access
automated_detection_testing: passed