LoFP / attach to policy can create a lot of noise. this search can be adjusted to provide specific values to identify cases of abuse (i.e status=failure). the search can provide context for common users attaching themselves to higher privilege policies or even newly created policies.

Techniques

• T1078

Sample rules

aws detect attach to role policy

• source: splunk
• technicques:
  • T1078

Description

The following analytic identifies a user attaching a policy to a different role’s trust policy in AWS. It leverages CloudWatch logs to detect the attach policy event, extracting relevant fields such as policyArn, sourceIPAddress, and userIdentity. This activity is significant as it can indicate attempts at lateral movement or privilege escalation within the AWS environment. If confirmed malicious, an attacker could gain elevated permissions, potentially compromising sensitive resources and data within the AWS infrastructure.

Detection logic

`aws_cloudwatchlogs_eks` attach policy
| spath requestParameters.policyArn 
| table sourceIPAddress user_access_key userIdentity.arn userIdentity.sessionContext.sessionIssuer.arn eventName errorCode errorMessage status action requestParameters.policyArn userIdentity.sessionContext.attributes.mfaAuthenticated userIdentity.sessionContext.attributes.creationDate  
| `aws_detect_attach_to_role_policy_filter`