AWSCloudTrail - Privilege escalation via CRUD IAM policy

Status: available
Severity: medium
Time window: 1d
Source: github.com/Azure/Azure-Sentinel

Detects creation of inline IAM policies that grant broad IAM create, read, update, and delete capabilities. This behavior can establish or expand privileged control paths in the account and should be reviewed as potential privilege escalation.

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1098.003` Account Manipulation: Additional Cloud Roles

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `PutRolePolicy`: Creates or updates an inline policy document embedded directly in the specified IAM role.
AWS	CloudTrail event `PutUserPolicy`: Creates or updates an inline policy document embedded directly in the specified IAM user.
AWS	CloudTrail event `PutGroupPolicy`: Adds or updates an inline policy document that is embedded in the specified IAM group.

Rules detecting the same action

These rules filter on the same operation.

Rule body

id: e20d35a3-4fec-4c8b-81b1-fc33b41990b0
name: AWSCloudTrail - Privilege escalation via CRUD IAM policy
description: |
  Detects creation of inline IAM policies that grant broad IAM create, read, update, and delete capabilities.
  This behavior can establish or expand privileged control paths in the account and should be reviewed as potential
  privilege escalation.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: AWS
    dataTypes:
      - AWSCloudTrail
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - PrivilegeEscalation
relevantTechniques:
  - T1098.003
query: |
    AWSCloudTrail
      | where EventName in ("PutUserPolicy","PutRolePolicy","PutGroupPolicy") and isempty(ErrorCode) and isempty(ErrorMessage)
      | extend PolicyName = tostring(parse_json(RequestParameters).policyName)
      | extend Statement = parse_json(tostring((parse_json(RequestParameters).policyDocument))).Statement
      | mvexpand Statement
      | extend Action = parse_json(Statement).Action , Effect = tostring(parse_json(Statement).Effect), Resource = tostring(parse_json(Statement).Resource), Condition = tostring(parse_json(Statement).Condition)
      | extend Action = tostring(Action)
      | where Effect =~ "Allow" and (Action contains "iam:Create" and (Action contains "iam:Get" or Action contains "iam:List")  and Action contains "iam:Update" and Action contains "iam:Delete") and Resource == "*" and Condition == ""
      | extend UserIdentityArn = iif(isempty(UserIdentityArn), tostring(parse_json(Resources)[0].ARN), UserIdentityArn)
      | extend UserName = tostring(split(UserIdentityArn, '/')[-1])
      | extend AccountName = case( UserIdentityPrincipalid == "Anonymous", "Anonymous", isempty(UserIdentityUserName), UserName, UserIdentityUserName)
      | extend AccountName = iif(AccountName contains "@", tostring(split(AccountName, '@', 0)[0]), AccountName),
        AccountUPNSuffix = iif(AccountName contains "@", tostring(split(AccountName, '@', 1)[0]), "")
      | distinct TimeGenerated, EventName, PolicyName, SourceIpAddress, RecipientAccountId, AccountName, AccountUPNSuffix, UserIdentityArn, UserIdentityUserName
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: AccountUPNSuffix
      - identifier: CloudAppAccountId
        columnName: RecipientAccountId
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIpAddress
customDetails:
  PolicyName: PolicyName
  EventName: EventName
  UserIdentityArn: UserIdentityArn
  RecipientAccountId: RecipientAccountId
alertDetailsOverride:
  alertDisplayNameFormat: 'AWS IAM privilege escalation policy update by {{AccountName}}'
  alertDescriptionFormat: 'Detected {{EventName}} Event, updating inline IAM escalation policy {{PolicyName}} in account {{RecipientAccountId}}.'
version: 1.0.2
kind: Scheduled

Stages and Predicates

Stage 1: `source`

AWSCloudTrail

Stage 2: `where`

| where EventName in ("PutUserPolicy","PutRolePolicy","PutGroupPolicy") and isempty(ErrorCode) and isempty(ErrorMessage)

Stage 3: `extend`

| extend PolicyName = tostring(parse_json(RequestParameters).policyName)

Stage 4: `extend`

| extend Statement = parse_json(tostring((parse_json(RequestParameters).policyDocument))).Statement

Stage 5: `mv-expand`

| mvexpand Statement

Stage 6: `extend`

| extend Action = parse_json(Statement).Action , Effect = tostring(parse_json(Statement).Effect), Resource = tostring(parse_json(Statement).Resource), Condition = tostring(parse_json(Statement).Condition)

Stage 7: `extend`

| extend Action = tostring(Action)

Stage 8: `where`

| where Effect =~ "Allow" and (Action contains "iam:Create" and (Action contains "iam:Get" or Action contains "iam:List")  and Action contains "iam:Update" and Action contains "iam:Delete") and Resource == "*" and Condition == ""

Stage 9: `extend` (4 consecutive steps)

| extend UserIdentityArn = iif(isempty(UserIdentityArn), tostring(parse_json(Resources)[0].ARN), UserIdentityArn)
| extend UserName = tostring(split(UserIdentityArn, '/')[-1])
| extend AccountName = case( UserIdentityPrincipalid == "Anonymous", "Anonymous", isempty(UserIdentityUserName), UserName, UserIdentityUserName)
| extend AccountName = iif(AccountName contains "@", tostring(split(AccountName, '@', 0)[0]), AccountName),
    AccountUPNSuffix = iif(AccountName contains "@", tostring(split(AccountName, '@', 1)[0]), "")

Stage 10: `distinct`

| distinct TimeGenerated, EventName, PolicyName, SourceIpAddress, RecipientAccountId, AccountName, AccountUPNSuffix, UserIdentityArn, UserIdentityUserName

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Action`	contains	`iam:Create` `iam:Delete` `iam:Get` `iam:List` `iam:Update`	`field:"Action" kind:contains`
`Effect`	eq	`Allow`	`field:"Effect" kind:eq value:"Allow"`
`ErrorCode`	is_null	(no value, null check)	`field:"aws::errorCode" kind:is_null`
`ErrorMessage`	is_null	(no value, null check)	`field:"aws::errorMessage" kind:is_null`
`EventName`	in	`PutGroupPolicy` `PutRolePolicy` `PutUserPolicy`	`field:"aws::eventName" kind:in`
`Resource`	eq	`*`	`field:"Resource" kind:eq value:"*"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`PolicyName`	`extend`
`Statement`	`extend`
`Action`	`extend`
`Condition`	`extend`
`Effect`	`extend`
`Resource`	`extend`
`UserIdentityArn`	`extend`
`UserName`	`extend`
`AccountName`	`extend`
`AccountUPNSuffix`	`extend`

AWSCloudTrail - Privilege escalation via CRUD IAM policy

MITRE ATT&CK coverage

Telemetry coverage

Rules detecting the same action

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: extend

Stage 4: extend

Stage 5: mv-expand

Stage 6: extend

Stage 7: extend

Stage 8: where

Stage 9: extend (4 consecutive steps)

Stage 10: distinct