From 4d4a4767d73397eeb9a1b4abeb94923fa79204e8 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 17 May 2022 17:36:49 -0700 Subject: [PATCH 1/2] search, data and yml updates --- ...ate_policy_version_to_allow_all_resources.yml | 16 ++++++++++------ ...olicy_version_to_allow_all_resources.test.yml | 2 +- 2 files changed, 11 insertions(+), 7 deletions(-) diff --git a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml index 2132c89ba9..73630b8f3a 100644 --- a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml +++ b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml @@ -1,7 +1,7 @@ name: AWS Create Policy Version to allow all resources id: 2a9b80d3-6340-4345-b5ad-212bf3d0dac4 -version: 2 -date: '2021-02-22' +version: 3 +date: '2022-05-17' author: Bhavin Patel, Splunk type: TTP datamodel: [] @@ -10,10 +10,10 @@ description: This search looks for AWS CloudTrail events where a user created a search: '`cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws.com errorCode = success | spath input=requestParameters.policyDocument output=key_policy_statements path=Statement{} | mvexpand key_policy_statements | spath input=key_policy_statements - output=key_policy_action_1 path=Action | search key_policy_action_1 = "*" | stats + output=key_policy_action_1 path=Action | where key_policy_action_1 = "*" | stats count min(_time) as firstTime max(_time) as lastTime values(key_policy_statements) as policy_added by eventName eventSource aws_account_id errorCode userAgent eventID - awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` + awsRegion user user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_create_policy_version_to_allow_all_resources_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. @@ -41,8 +41,7 @@ tags: impact: 70 kill_chain_phases: - Actions on Objectives - message: User $user$ created a policy version that allows them to access any resource - in their account + message: User $user$ created a policy version that allows them to access any resource in their account mitre_attack_id: - T1078.004 - T1078 @@ -64,6 +63,11 @@ tags: - eventName - userAgent - errorCode + - eventSource - requestParameters.userName + - requestParameters.policyDocument + - aws_account_id + - awsRegion + - eventID risk_score: 49 security_domain: network diff --git a/tests/cloud/aws_create_policy_version_to_allow_all_resources.test.yml b/tests/cloud/aws_create_policy_version_to_allow_all_resources.test.yml index 4a498b1b6b..9d4d9708d7 100644 --- a/tests/cloud/aws_create_policy_version_to_allow_all_resources.test.yml +++ b/tests/cloud/aws_create_policy_version_to_allow_all_resources.test.yml @@ -2,7 +2,7 @@ name: AWS Create Policy Version to allow all resources Unit Test tests: - name: AWS Create Policy Version to allow all resources file: cloud/aws_create_policy_version_to_allow_all_resources.yml - pass_condition: '| stats count | where count > 0' + pass_condition: '| stats count | where count = 1' earliest_time: -7d latest_time: now attack_data: From aa4499a05086917f9b270bbdf28d74a72752c3ed Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 18 May 2022 12:31:41 -0700 Subject: [PATCH 2/2] minor grammar fixes --- .../aws_create_policy_version_to_allow_all_resources.yml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml index 73630b8f3a..65df63e746 100644 --- a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml +++ b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml @@ -5,8 +5,7 @@ date: '2022-05-17' author: Bhavin Patel, Splunk type: TTP datamodel: [] -description: This search looks for AWS CloudTrail events where a user created a policy - version that allows them to access any resource in their account +description: This search looks for AWS CloudTrail events where a user created a policy version that allows them to access any resource in their account. search: '`cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws.com errorCode = success | spath input=requestParameters.policyDocument output=key_policy_statements path=Statement{} | mvexpand key_policy_statements | spath input=key_policy_statements @@ -20,7 +19,7 @@ how_to_implement: You must install splunk AWS add on and Splunk App for AWS. Thi known_false_positives: While this search has no known false positives, it is possible that an AWS admin has legitimately created a policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all - AWS resources + AWS resources and you must verify this activity. references: - https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/ @@ -41,7 +40,7 @@ tags: impact: 70 kill_chain_phases: - Actions on Objectives - message: User $user$ created a policy version that allows them to access any resource in their account + message: User $user$ created a policy version that allows them to access any resource in their account. mitre_attack_id: - T1078.004 - T1078