AWSCloudTrail - Policy version set to default

Status: available
Severity: medium
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

Detects SetDefaultPolicyVersion activity that makes a different IAM policy version active. Attackers can use this to activate previously created permissive versions and escalate access.

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1098.003` Account Manipulation: Additional Cloud Roles

Rule body

id: 874a1762-3fd7-4489-b411-6d4a9e9e8a59
name: AWSCloudTrail - Policy version set to default
description: |
  Detects SetDefaultPolicyVersion activity that makes a different IAM policy version active.
  Attackers can use this to activate previously created permissive versions and escalate access.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: AWS
    dataTypes:
      - AWSCloudTrail
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - PrivilegeEscalation    
relevantTechniques:
  - T1098.003
query: |
    AWSCloudTrail
    | where EventName == "SetDefaultPolicyVersion" and isempty(ErrorCode) and isempty(ErrorMessage)
    | extend UserIdentityArn = iif(isempty(UserIdentityArn), tostring(parse_json(Resources)[0].ARN), UserIdentityArn)
    | extend UserName = tostring(split(UserIdentityArn, '/')[-1])
    | extend AccountName = case( UserIdentityPrincipalid == "Anonymous", "Anonymous", isempty(UserIdentityUserName), UserName, UserIdentityUserName)
    | extend AccountName = iif(AccountName contains "@", tostring(split(AccountName, '@', 0)[0]), AccountName),
      AccountUPNSuffix = iif(AccountName contains "@", tostring(split(AccountName, '@', 1)[0]), "")
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: AccountUPNSuffix
      - identifier: CloudAppAccountId
        columnName: RecipientAccountId
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIpAddress
customDetails:
  EventName: EventName
  EventSource: EventSource
  AWSRegion: AWSRegion
  UserIdentityArn: UserIdentityArn
alertDetailsOverride:
  alertDisplayNameFormat: 'AWS IAM default policy version changed by {{AccountName}}'
  alertDescriptionFormat: 'Detected SetDefaultPolicyVersion from {{SourceIpAddress}} in account {{RecipientAccountId}}.'
version: 1.0.2
kind: Scheduled

Stages and Predicates

Stage 1: `source`

AWSCloudTrail

Stage 2: `where`

| where EventName == "SetDefaultPolicyVersion" and isempty(ErrorCode) and isempty(ErrorMessage)

Stage 3: `extend` (4 consecutive steps)

| extend UserIdentityArn = iif(isempty(UserIdentityArn), tostring(parse_json(Resources)[0].ARN), UserIdentityArn)
| extend UserName = tostring(split(UserIdentityArn, '/')[-1])
| extend AccountName = case( UserIdentityPrincipalid == "Anonymous", "Anonymous", isempty(UserIdentityUserName), UserName, UserIdentityUserName)
| extend AccountName = iif(AccountName contains "@", tostring(split(AccountName, '@', 0)[0]), AccountName),
  AccountUPNSuffix = iif(AccountName contains "@", tostring(split(AccountName, '@', 1)[0]), "")

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ErrorCode`	is_null	(no value, null check)	`field:"aws::errorCode" kind:is_null`
`ErrorMessage`	is_null	(no value, null check)	`field:"aws::errorMessage" kind:is_null`
`EventName`	eq	`SetDefaultPolicyVersion`	`field:"aws::eventName" kind:eq value:"SetDefaultPolicyVersion"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`UserIdentityArn`	`extend`
`UserName`	`extend`
`AccountName`	`extend`
`AccountUPNSuffix`	`extend`