mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
65 lines
2.0 KiB
YAML
65 lines
2.0 KiB
YAML
name: aws detect role creation
|
|
id: 5f04081e-ddee-4353-afe4-504f288de9ad
|
|
version: 1
|
|
date: '2020-07-27'
|
|
author: Rod Soto, Splunk
|
|
type: Hunting
|
|
datamodel: []
|
|
description: This search provides detection of role creation by IAM users. Role creation
|
|
is an event by itself if user is creating a new role with trust policies different
|
|
than the available in AWS and it can be used for lateral movement and escalation
|
|
of privileges.
|
|
search: '`aws_cloudwatchlogs_eks` event_name=CreateRole action=created userIdentity.type=AssumedRole
|
|
requestParameters.description=Allows* | table sourceIPAddress userIdentity.principalId
|
|
userIdentity.arn action event_name awsRegion http_user_agent mfa_auth msg requestParameters.roleName
|
|
requestParameters.description responseElements.role.arn responseElements.role.createDate
|
|
| `aws_detect_role_creation_filter`'
|
|
how_to_implement: You must install splunk AWS add-on and Splunk App for AWS. This
|
|
search works with cloudwatch logs
|
|
known_false_positives: CreateRole is not very common in common users. This search
|
|
can be adjusted to provide specific values to identify cases of abuse. In general
|
|
AWS provides plenty of trust policies that fit most use cases.
|
|
references: []
|
|
tags:
|
|
analytic_story:
|
|
- AWS Cross Account Activity
|
|
asset_type: AWS Account
|
|
kill_chain_phases:
|
|
- Exploitation
|
|
mitre_attack_id:
|
|
- T1078
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- event_name
|
|
- action
|
|
- userIdentity.type
|
|
- requestParameters.description
|
|
- sourceIPAddress
|
|
- userIdentity.principalId
|
|
- userIdentity.arn
|
|
- action
|
|
- event_name
|
|
- awsRegion
|
|
- http_user_agent
|
|
- mfa_auth
|
|
- msg
|
|
- requestParameters.roleName
|
|
- requestParameters.description
|
|
- responseElements.role.arn
|
|
- responseElements.role.createDate
|
|
security_domain: threat
|
|
confidence: 50
|
|
impact: 50
|
|
risk_score: 25
|
|
context: []
|
|
observable:
|
|
- name: user
|
|
type: User
|
|
role:
|
|
- Victim
|
|
message: tbd
|