first search

detections/cloud/aws_create_policy_version_to_allow_all_resources.yml

@@ -0,0 +1,47 @@
+name: AWS Create Policy Version to allow all resources
+id: 2a9b80d3-6340-4345-b5ad-212bf3d0dac4
+version: 2
+date: '2021-02-22'
+author: Bhavin Patel, Splunk
+type: batch
+datamodel: []
+description: This search looks for CloudTrail events where a user created a policy version that allows them to access any resource in their account
+search: '`cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws.com
+| spath input=requestParameters.policyDocument output=key_policy_statements path=Statement{} 
+| mvexpand key_policy_statements 
+| spath input=key_policy_statements output=key_policy_action_1 path=Action 
+| search key_policy_action_1 = "*" 
+| stats count min(_time) as firstTime max(_time) as lastTime values(key_policy_statements) by eventName eventSource aws_account_id errorCode http_user_agent
+    eventID awsRegion userIdentity.principalId user_arn
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)`| `aws_create_policy_version_to_allow_all_resources_filter`'
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with cloudtrail logs.
+known_false_positives: While this search has no known false positives, it is possible
+  that an AWS admin has legitimately created a policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources
+references:
+  - https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws
+  - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
+tags:
+  analytic_story:
+  - 
+  asset_type: AWS Account
+  cis20:
+  - CIS 13
+  kill_chain_phases:
+  - Actions on Objectives
+  mitre_attack_id:
+  - T1078
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  product:
+  - Splunk Security Analytics for AWS
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_object: src
+  risk_object_type: system
+  risk_score: 20
+  security_domain: network

tests/cloud/aws_create_policy_version_to_allow_all_resources.test.yml

@@ -0,0 +1,13 @@
+name: AWS Create Policy Version to allow all resources Unit Test
+tests:
+- name: AWS Create Policy Version to allow all resources
+  file: cloud/aws_create_policy_version_to_allow_all_resources.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: aws_cloudtrail_events.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_create_policy_version/aws_cloudtrail_events.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail
+    update_timestamp: True