Name:aws detect attach to role policy id:88fc31dd-f331-448c-9856-d3d51dd5d3a1 version:3 date:2024-10-17 author:Rod Soto, Splunk status:experimental type:Hunting Description:The following analytic identifies a user attaching a policy to a different role's trust policy in AWS. It leverages CloudWatch logs to detect the `attach policy` event, extracting relevant fields such as `policyArn`, `sourceIPAddress`, and `userIdentity`. This activity is significant as it can indicate attempts at lateral movement or privilege escalation within the AWS environment. If confirmed malicious, an attacker could gain elevated permissions, potentially compromising sensitive resources and data within the AWS infrastructure. Data_source:
how_to_implement:You must install splunk AWS add-on and Splunk App for AWS. This search works with cloudwatch logs known_false_positives:Attach to policy can create a lot of noise. This search can be adjusted to provide specific values to identify cases of abuse (i.e status=failure). The search can provide context for common users attaching themselves to higher privilege policies or even newly created policies. References: drilldown_searches:
: tags: analytic_story: - 'AWS Cross Account Activity' asset_type:AWS Account confidence:50 impact:50 message:tbd mitre_attack_id: - 'T1078' observable: name:'user' type:'User' - role: - 'Victim' product: - 'Splunk Enterprise' - 'Splunk Enterprise Security' - 'Splunk Cloud' required_fields: - '_time' - 'requestParameters.policyArn' risk_score:25 security_domain:threat
