admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-05-18 15:51:06 -04:00
committed by GitHub
parent 44c98a987d f1085bb59e
commit f5ebfc44d1
2 changed files with 13 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/aws_create_policy_version_to_allow_all_resources.yml
+12 -9
View File
@@ -1,26 +1,25 @@
name: AWS Create Policy Version to allow all resources
id: 2a9b80d3-6340-4345-b5ad-212bf3d0dac4
version: 2
date: '2021-02-22'
version: 3
date: '2022-05-17'
author: Bhavin Patel, Splunk
type: TTP
datamodel: []
description: This search looks for AWS CloudTrail events where a user created a policy
version that allows them to access any resource in their account
description: This search looks for AWS CloudTrail events where a user created a policy version that allows them to access any resource in their account.
search: '`cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws.com
errorCode = success | spath input=requestParameters.policyDocument output=key_policy_statements
path=Statement{} | mvexpand key_policy_statements | spath input=key_policy_statements
output=key_policy_action_1 path=Action | search key_policy_action_1 = "*" | stats
output=key_policy_action_1 path=Action | where key_policy_action_1 = "*" | stats
count min(_time) as firstTime max(_time) as lastTime values(key_policy_statements)
as policy_added by eventName eventSource aws_account_id errorCode userAgent eventID
awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)`
awsRegion user user_arn | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`|`aws_create_policy_version_to_allow_all_resources_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
known_false_positives: While this search has no known false positives, it is possible
that an AWS admin has legitimately created a policy to allow a user to access all
resources. That said, AWS strongly advises against granting full control to all
AWS resources
AWS resources and you must verify this activity.
references:
- https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws
- https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
@@ -41,8 +40,7 @@ tags:
impact: 70
kill_chain_phases:
- Actions on Objectives
message: User $user$ created a policy version that allows them to access any resource
in their account
message: User $user$ created a policy version that allows them to access any resource in their account.
mitre_attack_id:
- T1078.004
- T1078
@@ -64,6 +62,11 @@ tags:
- eventName
- userAgent
- errorCode
- eventSource
- requestParameters.userName
- requestParameters.policyDocument
- aws_account_id
- awsRegion
- eventID
risk_score: 49
security_domain: network
tests/cloud/aws_create_policy_version_to_allow_all_resources.test.yml
+1 -1
View File
@@ -2,7 +2,7 @@ name: AWS Create Policy Version to allow all resources Unit Test
tests:
- name: AWS Create Policy Version to allow all resources
file: cloud/aws_create_policy_version_to_allow_all_resources.yml
pass_condition: '| stats count | where count > 0'
pass_condition: '| stats count | where count = 1'
earliest_time: -7d
latest_time: now
attack_data: