aws_setdefaultpolicyversion.yml

name: AWS SetDefaultPolicyVersion
id: 2a9b80d3-6340-4345-11ad-212bf3d0dac4
version: 1
date: '2021-03-02'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: This search looks for AWS CloudTrail events where a user has set a default
  policy versions. Attackers have been know to use this technique for Privilege Escalation
  in case the previous versions of the policy had permissions to access more resources
  than the current version of the policy
data_source: []
search: '`cloudtrail` eventName=SetDefaultPolicyVersion eventSource = iam.amazonaws.com
  | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyArn)
  as policy_arn by src requestParameters.versionId eventName eventSource aws_account_id
  errorCode userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `aws_setdefaultpolicyversion_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
  search works with AWS CloudTrail logs.
known_false_positives: While this search has no known false positives, it is possible
  that an AWS admin has legitimately set a default policy to allow a user to access
  all resources. That said, AWS strongly advises against granting full control to
  all AWS resources
references:
- https://bishopfox.com/blog/privilege-escalation-in-aws
- https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
tags:
  analytic_story:
  - AWS IAM Privilege Escalation
  asset_type: AWS Account
  confidence: 60
  impact: 50
  message: From IP address $src$, user $user_arn$ has trigged an
    event $eventName$ for updating the the default policy version
  mitre_attack_id:
  - T1078.004
  - T1078
  observable:
  - name: src
    type: IP Address
    role:
    - Attacker
  - name: user_arn
    type: User
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - eventName
  - userAgent
  - errorCode
  - requestParameters.userName
  - eventSource
  risk_score: 30
  security_domain: threat
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_setdefaultpolicyversion/aws_cloudtrail_events.json
    sourcetype: aws:cloudtrail
    source: aws_cloudtrail
    update_timestamp: true