AWS IAM S3Browser Templated S3 Bucket Policy Creation

Status: test
Severity: high
Log source: product aws, service cloudtrail
Author: daniel.bohannon@permiso.io (@danielhbohannon)
Source: github.com/SigmaHQ/sigma

Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "<YOUR-BUCKET-NAME>".

Known false positives

Valid usage of S3 browser with accidental creation of default Inline IAM policy without changing default S3 bucket name placeholder value

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078.004` Valid Accounts: Cloud Accounts
Execution	`T1059.009` Command and Scripting Interpreter: Cloud API
Persistence	`T1078.004` Valid Accounts: Cloud Accounts
Privilege Escalation	`T1078.004` Valid Accounts: Cloud Accounts
Stealth	`T1078.004` Valid Accounts: Cloud Accounts

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `PutUserPolicy`: Creates or updates an inline policy document embedded directly in the specified IAM user.

Rules detecting the same action

These rules filter on the same operation.

AWS IAM Sensitive Operations via Lambda Execution Role (Elastic)
AWS Sensitive IAM Operations Performed via CloudShell (Elastic)

Rule body

title: AWS IAM S3Browser Templated S3 Bucket Policy Creation
id: db014773-7375-4f4e-b83b-133337c0ffee
status: test
description: Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "<YOUR-BUCKET-NAME>".
references:
    - https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor
author: daniel.bohannon@permiso.io (@danielhbohannon)
date: 2023-05-17
tags:
    - attack.execution
    - attack.stealth
    - attack.t1059.009
    - attack.persistence
    - attack.initial-access
    - attack.privilege-escalation
    - attack.t1078.004
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: iam.amazonaws.com
        eventName: PutUserPolicy
        userAgent|contains: 'S3 Browser'
        requestParameters|contains|all:
            - '"arn:aws:s3:::<YOUR-BUCKET-NAME>/*"'
            - '"s3:GetObject"'
            - '"Allow"'
    condition: selection
falsepositives:
    - Valid usage of S3 browser with accidental creation of default Inline IAM policy without changing default S3 bucket name placeholder value
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    eventSource: iam.amazonaws.com
    eventName: PutUserPolicy
    userAgent|contains: 'S3 Browser'
    requestParameters|contains|all:
        - '"arn:aws:s3:::<YOUR-BUCKET-NAME>/*"'
        - '"s3:GetObject"'
        - '"Allow"'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`PutUserPolicy`	`field:"aws::eventName" kind:eq value:"PutUserPolicy"`
`eventSource`	eq	`iam.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"iam.amazonaws.com"`
`requestParameters`	match	`"Allow"` `"arn:aws:s3:::<YOUR-BUCKET-NAME>/*"` `"s3:GetObject"`	`field:"aws::requestParameters" kind:match`
`userAgent`	match	`S3 Browser`	`field:"userAgent" kind:match value:"S3 Browser"`