mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
69 lines
2.6 KiB
YAML
69 lines
2.6 KiB
YAML
name: AWS IAM Delete Policy
|
|
id: ec3a9362-92fe-11eb-99d0-acde48001122
|
|
version: 1
|
|
date: '2021-04-01'
|
|
author: Michael Haag, Splunk
|
|
type: Hunting
|
|
datamodel: []
|
|
description: The following detection identifes when a policy is deleted on AWS. This
|
|
does not identify whether successful or failed, but the error messages tell a story
|
|
of suspicious attempts. There is a specific process to follow when deleting a policy.
|
|
First, detach the policy from all users, groups, and roles that the policy is attached
|
|
to, using DetachUserPolicy , DetachGroupPolicy , or DetachRolePolicy.
|
|
search: '`cloudtrail` eventName=DeletePolicy (userAgent!=*.amazonaws.com) | stats
|
|
count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyArn)
|
|
as policyArn by src eventName eventSource aws_account_id errorCode errorMessage
|
|
userAgent eventID awsRegion userIdentity.principalId userIdentity.arn | `security_content_ctime(firstTime)`
|
|
| `security_content_ctime(lastTime)` | `aws_iam_delete_policy_filter`'
|
|
how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
|
|
this data. The search requires AWS Cloudtrail logs.
|
|
known_false_positives: This detection will require tuning to provide high fidelity
|
|
detection capabilties. Tune based on src addresses (corporate offices, VPN terminations)
|
|
or by groups of users. Not every user with AWS access should have permission to
|
|
delete policies (least privilege). In addition, this may be saved seperately and
|
|
tuned for failed or success attempts only.
|
|
references:
|
|
- https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeletePolicy.html
|
|
- https://docs.aws.amazon.com/cli/latest/reference/iam/delete-policy.html
|
|
tags:
|
|
analytic_story:
|
|
- AWS IAM Privilege Escalation
|
|
automated_detection_testing: passed
|
|
confidence: 50
|
|
context:
|
|
- Source:Cloud Data
|
|
- Scope:External
|
|
- Stage:Execution
|
|
- Other:Policy Violation
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_delete_policy/aws_iam_delete_policy.json
|
|
impact: 20
|
|
kill_chain_phases:
|
|
- Actions on Objectives
|
|
message: User $user_arn$ has deleted AWS Policies from IP address $src$ by executing
|
|
the following command $eventName$
|
|
mitre_attack_id:
|
|
- T1098
|
|
observable:
|
|
- name: src
|
|
type: IP Address
|
|
role:
|
|
- Attacker
|
|
- name: user_arn
|
|
type: User
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
- Splunk Security Analytics for AWS
|
|
required_fields:
|
|
- _time
|
|
- eventName
|
|
- userAgent
|
|
- errorCode
|
|
- requestParameters.policyArn
|
|
risk_score: 10
|
|
security_domain: access
|