Sample rules
AWS IAM User Created Access Keys For Another User
- source: elastic
- technicques:
- T1098
Description
An adversary with access to a set of compromised credentials may attempt to persist or escalate privileges by
creating a new set of credentials for an existing user. This rule looks for use of the IAM CreateAccessKey
API operation
to create new programatic access keys for another IAM user.
Detection logic
from logs-aws.cloudtrail-*
| where event.provider == "iam.amazonaws.com" and event.action == "CreateAccessKey" and event.outcome == "success" and user.name != user.target.name
AWS IAM AdministratorAccess Policy Attached to Group
- source: elastic
- technicques:
- T1098
Description
An adversary with access to a set of compromised credentials may attempt to persist or escalate privileges by
attaching additional permissions to user groups the compromised user account belongs to. This rule looks for use of
the IAM AttachGroupPolicy
API operation to attach the highly permissive AdministratorAccess
AWS managed policy
to an existing IAM user group.
Detection logic
from logs-aws.cloudtrail-*
| where event.provider == "iam.amazonaws.com" and event.action == "AttachGroupPolicy" and event.outcome == "success"
| dissect aws.cloudtrail.request_parameters "{%{?policyArn}=%{?arn}:%{?aws}:%{?iam}::%{?aws}:%{?policy}/%{policyName},%{?groupName}=%{group.name}}"
| where policyName == "AdministratorAccess"
Sample rules
AWS IAM User Created Access Keys For Another User
- source: elastic
- technicques:
- T1098
Description
An adversary with access to a set of compromised credentials may attempt to persist or escalate privileges by
creating a new set of credentials for an existing user. This rule looks for use of the IAM CreateAccessKey
API operation
to create new programatic access keys for another IAM user.
Detection logic
from logs-aws.cloudtrail-*
| where event.provider == "iam.amazonaws.com" and event.action == "CreateAccessKey" and event.outcome == "success" and user.name != user.target.name
AWS IAM AdministratorAccess Policy Attached to Group
- source: elastic
- technicques:
- T1098
Description
An adversary with access to a set of compromised credentials may attempt to persist or escalate privileges by
attaching additional permissions to user groups the compromised user account belongs to. This rule looks for use of
the IAM AttachGroupPolicy
API operation to attach the highly permissive AdministratorAccess
AWS managed policy
to an existing IAM user group.
Detection logic
from logs-aws.cloudtrail-*
| where event.provider == "iam.amazonaws.com" and event.action == "AttachGroupPolicy" and event.outcome == "success"
| dissect aws.cloudtrail.request_parameters "{%{?policyArn}=%{?arn}:%{?aws}:%{?iam}::%{?aws}:%{?policy}/%{policyName},%{?groupName}=%{group.name}}"
| where policyName == "AdministratorAccess"
AWS IAM AdministratorAccess Policy Attached to Role
- source: elastic
- technicques:
- T1098
Description
An adversary with access to a set of compromised credentials may attempt to persist or escalate privileges by
attaching additional permissions to compromised IAM roles. This rule looks for use of the IAM AttachRolePolicy
API operation
to attach the highly permissive AdministratorAccess
AWS managed policy to an existing IAM role.
Detection logic
from logs-aws.cloudtrail-*
| where event.provider == "iam.amazonaws.com" and event.action == "AttachRolePolicy" and event.outcome == "success"
| dissect aws.cloudtrail.request_parameters "{%{?policyArn}=%{?arn}:%{?aws}:%{?iam}::%{?aws}:%{?policy}/%{policyName},%{?roleName}=%{role.name}}"
| where policyName == "AdministratorAccess"
Sample rules
AWS IAM User Created Access Keys For Another User
- source: elastic
- technicques:
- T1098
Description
An adversary with access to a set of compromised credentials may attempt to persist or escalate privileges by
creating a new set of credentials for an existing user. This rule looks for use of the IAM CreateAccessKey
API operation
to create new programatic access keys for another IAM user.
Detection logic
from logs-aws.cloudtrail-*
| where event.provider == "iam.amazonaws.com" and event.action == "CreateAccessKey" and event.outcome == "success" and user.name != user.target.name
AWS IAM AdministratorAccess Policy Attached to Group
- source: elastic
- technicques:
- T1098
Description
An adversary with access to a set of compromised credentials may attempt to persist or escalate privileges by
attaching additional permissions to user groups the compromised user account belongs to. This rule looks for use of
the IAM AttachGroupPolicy
API operation to attach the highly permissive AdministratorAccess
AWS managed policy
to an existing IAM user group.
Detection logic
from logs-aws.cloudtrail-*
| where event.provider == "iam.amazonaws.com" and event.action == "AttachGroupPolicy" and event.outcome == "success"
| dissect aws.cloudtrail.request_parameters "{%{?policyArn}=%{?arn}:%{?aws}:%{?iam}::%{?aws}:%{?policy}/%{policyName},%{?groupName}=%{group.name}}"
| where policyName == "AdministratorAccess"
Sample rules
AWS IAM User Created Access Keys For Another User
- source: elastic
- technicques:
- T1098
Description
An adversary with access to a set of compromised credentials may attempt to persist or escalate privileges by
creating a new set of credentials for an existing user. This rule looks for use of the IAM CreateAccessKey
API operation
to create new programatic access keys for another IAM user.
Detection logic
from logs-aws.cloudtrail-*
| where event.provider == "iam.amazonaws.com" and event.action == "CreateAccessKey" and event.outcome == "success" and user.name != user.target.name
AWS IAM AdministratorAccess Policy Attached to Group
- source: elastic
- technicques:
- T1098
Description
An adversary with access to a set of compromised credentials may attempt to persist or escalate privileges by
attaching additional permissions to user groups the compromised user account belongs to. This rule looks for use of
the IAM AttachGroupPolicy
API operation to attach the highly permissive AdministratorAccess
AWS managed policy
to an existing IAM user group.
Detection logic
from logs-aws.cloudtrail-*
| where event.provider == "iam.amazonaws.com" and event.action == "AttachGroupPolicy" and event.outcome == "success"
| dissect aws.cloudtrail.request_parameters "{%{?policyArn}=%{?arn}:%{?aws}:%{?iam}::%{?aws}:%{?policy}/%{policyName},%{?groupName}=%{group.name}}"
| where policyName == "AdministratorAccess"
AWS IAM AdministratorAccess Policy Attached to Role
- source: elastic
- technicques:
- T1098
Description
An adversary with access to a set of compromised credentials may attempt to persist or escalate privileges by
attaching additional permissions to compromised IAM roles. This rule looks for use of the IAM AttachRolePolicy
API operation
to attach the highly permissive AdministratorAccess
AWS managed policy to an existing IAM role.
Detection logic
from logs-aws.cloudtrail-*
| where event.provider == "iam.amazonaws.com" and event.action == "AttachRolePolicy" and event.outcome == "success"
| dissect aws.cloudtrail.request_parameters "{%{?policyArn}=%{?arn}:%{?aws}:%{?iam}::%{?aws}:%{?policy}/%{policyName},%{?roleName}=%{role.name}}"
| where policyName == "AdministratorAccess"
AWS IAM AdministratorAccess Policy Attached to User
- source: elastic
- technicques:
- T1098
Description
An adversary with access to a set of compromised credentials may attempt to persist or escalate privileges by
attaching additional permissions to compromised user accounts. This rule looks for use of the IAM AttachUserPolicy
API operation
to attach the highly permissive AdministratorAccess
AWS managed policy to an existing IAM user.
Detection logic
from logs-aws.cloudtrail-*
| where event.provider == "iam.amazonaws.com" and event.action == "AttachUserPolicy" and event.outcome == "success"
| dissect aws.cloudtrail.request_parameters "{%{?policyArn}=%{?arn}:%{?aws}:%{?iam}::%{?aws}:%{?policy}/%{policyName},%{?userName}=%{target.userName}}"
| where policyName == "AdministratorAccess"