AWS Security Hub - Detect IAM Policies allowing full administrative privileges

Status: available
Severity: high
Time window: 1h
Group by: AwsAccountId, AwsRegion, AwsSecurityFindingDescription, AwsSecurityFindingId, AwsSecurityFindingTitle, ComplianceSecurityControlId, IAMPolicyDescription, IAMPolicyId, IAMPolicyName
Source: github.com/Azure/Azure-Sentinel

This query detects AWS IAM policies that allow full administrative ("*") privileges in violation of AWS Security Hub control IAM.1. Overly permissive policies increase the risk of privilege escalation and unauthorized access.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1078.001` Valid Accounts: Default Accounts `T1098.003` Account Manipulation: Additional Cloud Roles
Privilege Escalation	`T1078.001` Valid Accounts: Default Accounts `T1098.003` Account Manipulation: Additional Cloud Roles

Rule body

id: de1f71d2-d127-439d-a8a2-e64d3187298a
name: AWS Security Hub - Detect IAM Policies allowing full administrative privileges
description: |
  This query detects AWS IAM policies that allow full administrative ("*") privileges in violation of AWS Security Hub control IAM.1.
  Overly permissive policies increase the risk of privilege escalation and unauthorized access.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: AWSSecurityHub
    dataTypes:
      - AWSSecurityHubFindings
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Persistence
  - PrivilegeEscalation
relevantTechniques:
  - T1098.003
  - T1078.001
tags:
  - PCI DSS v3.2.1
  - NIST 800-53 r5
  - CIS AWS Foundations Benchmark v1.4.0
query: |
  AWSSecurityHubFindings
  | where RecordState == "ACTIVE" and ComplianceStatus == "FAILED"
  // Match Security Hub control IAM.1 by GeneratorId or explicit SecurityControlId/Title
  | where tostring(AwsSecurityFindingGeneratorId) == "security-control/IAM.1"
    or tostring(ComplianceSecurityControlId) == "IAM.1"
  | extend
    IAMPolicyId = tostring(Resources[0].Details.AwsIamPolicy.PolicyId),
    IAMPolicyName =  tostring(Resources[0].Details.AwsIamPolicy.PolicyName),
    IAMPolicyDescription = tostring(Resources[0].Details.AwsIamPolicy.Description)
  | summarize TimeGenerated = max(TimeGenerated)
    by
    AwsAccountId,
    AwsRegion,
    AwsSecurityFindingTitle,
    AwsSecurityFindingDescription,
    AwsSecurityFindingId,
    ComplianceSecurityControlId,
    IAMPolicyId,
    IAMPolicyName,
    IAMPolicyDescription
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AwsAccountId
      - identifier: CloudAppAccountId
        columnName: AwsAccountId
customDetails:
  ComplianceControlId: ComplianceSecurityControlId
  Region: AwsRegion
  FindingId: AwsSecurityFindingId
alertDetailsOverride:
  alertDisplayNameFormat: "AWS Account {{AwsAccountId}} has IAM Policy with full administrative privileges"
  alertDescriptionFormat: "AWS Account {{AwsAccountId}} has IAM Policy {{IAMPolicyId}} with full administrative privileges."
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

AWSSecurityHubFindings

Stage 2: `where`

| where RecordState == "ACTIVE" and ComplianceStatus == "FAILED"

Stage 3: `where`

| where tostring(AwsSecurityFindingGeneratorId) == "security-control/IAM.1"
  or tostring(ComplianceSecurityControlId) == "IAM.1"

Stage 4: `extend`

| extend
  IAMPolicyId = tostring(Resources[0].Details.AwsIamPolicy.PolicyId),
  IAMPolicyName =  tostring(Resources[0].Details.AwsIamPolicy.PolicyName),
  IAMPolicyDescription = tostring(Resources[0].Details.AwsIamPolicy.Description)

Stage 5: `summarize`

| summarize TimeGenerated = max(TimeGenerated)
  by
  AwsAccountId,
  AwsRegion,
  AwsSecurityFindingTitle,
  AwsSecurityFindingDescription,
  AwsSecurityFindingId,
  ComplianceSecurityControlId,
  IAMPolicyId,
  IAMPolicyName,
  IAMPolicyDescription

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AwsSecurityFindingGeneratorId`	eq	`security-control/IAM.1` transforms: `tostring`	`field:"AwsSecurityFindingGeneratorId" kind:eq value:"security-control/IAM.1"`
`ComplianceSecurityControlId`	eq	`IAM.1` transforms: `tostring`	`field:"ComplianceSecurityControlId" kind:eq value:"IAM.1"`
`ComplianceStatus`	eq	`FAILED`	`field:"ComplianceStatus" kind:eq value:"FAILED"`
`RecordState`	eq	`ACTIVE`	`field:"RecordState" kind:eq value:"ACTIVE"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AwsAccountId`	`summarize`
`AwsRegion`	`summarize`
`AwsSecurityFindingDescription`	`summarize`
`AwsSecurityFindingId`	`summarize`
`AwsSecurityFindingTitle`	`summarize`
`ComplianceSecurityControlId`	`summarize`
`IAMPolicyDescription`	`summarize`
`IAMPolicyId`	`summarize`
`IAMPolicyName`	`summarize`
`TimeGenerated`	`summarize`

AWS Security Hub - Detect IAM Policies allowing full administrative privileges

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: extend