From 8571958958cec402adcc5f02acb3946deb2bda63 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 19 Mar 2021 00:11:44 +0000 Subject: [PATCH] Added detection testing service results inAWS UpdateLoginProfile --- detections/cloud/aws_updateloginprofile.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/detections/cloud/aws_updateloginprofile.yml b/detections/cloud/aws_updateloginprofile.yml index 450fa9fe55..431d7ae19e 100644 --- a/detections/cloud/aws_updateloginprofile.yml +++ b/detections/cloud/aws_updateloginprofile.yml @@ -6,7 +6,9 @@ author: Bhavin Patel, Splunk type: batch datamodel: [] description: This search looks for CloudTrail events where a user A who has already - permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) + permission to update login profile, makes an API call to update login profile for + another user B . Attackers have been know to use this technique for Privilege Escalation + in case new victim(user B) has more permissions than old victim(user B) search: '`cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com errorCode = success| search userName!=requestParameters.userName | stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName src @@ -48,3 +50,6 @@ tags: risk_object_type: system risk_score: 20 security_domain: network + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_updateloginprofile/aws_cloudtrail_events.json