admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'aws_priv_escalation' of https://github.com/splunk/security_content into aws_priv_escalation

Browse Source
This commit is contained in:
Detection Testing Service
2021-03-19 00:27:16 +00:00
parent 52e2b6f0ae 7ae972a31d
commit f68299b365
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/aws_updateloginprofile.yml
+6 -1
View File
@@ -6,7 +6,9 @@ author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events where a user A who has already
permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B)
permission to update login profile, makes an API call to update login profile for
another user B . Attackers have been know to use this technique for Privilege Escalation
in case new victim(user B) has more permissions than old victim(user B)
search: '`cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com
errorCode = success| search userName!=requestParameters.userName | stats count
min(_time) as firstTime max(_time) as lastTime by requestParameters.userName src
@@ -48,3 +50,6 @@ tags:
risk_object_type: system
risk_score: 20
security_domain: network
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_updateloginprofile/aws_cloudtrail_events.json