AWSCloudTrail - Policy version set to default | Microsoft Sentinel Analytic Rules

Back


Id	874a1762-3fd7-4489-b411-6d4a9e9e8a59
Rulename	AWSCloudTrail - Policy version set to default
Description	Detects SetDefaultPolicyVersion activity that makes a different IAM policy version active. Attackers can use this to activate previously created permissive versions and escalate access.
Severity	Medium
Tactics	PrivilegeEscalation
Techniques	T1098.003
Required data connectors	AWS
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Amazon%20Web%20Services/Analytic%20Rules/AWS_SetDefaulyPolicyVersion.yaml
Version	1.0.2
Arm template	874a1762-3fd7-4489-b411-6d4a9e9e8a59.json

KQL

AWSCloudTrail
| where EventName == "SetDefaultPolicyVersion" and isempty(ErrorCode) and isempty(ErrorMessage)
| extend UserIdentityArn = iif(isempty(UserIdentityArn), tostring(parse_json(Resources)[0].ARN), UserIdentityArn)
| extend UserName = tostring(split(UserIdentityArn, '/')[-1])
| extend AccountName = case( UserIdentityPrincipalid == "Anonymous", "Anonymous", isempty(UserIdentityUserName), UserName, UserIdentityUserName)
| extend AccountName = iif(AccountName contains "@", tostring(split(AccountName, '@', 0)[0]), AccountName),
  AccountUPNSuffix = iif(AccountName contains "@", tostring(split(AccountName, '@', 1)[0]), "")

YAML

entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountName
  - identifier: UPNSuffix
    columnName: AccountUPNSuffix
  - identifier: CloudAppAccountId
    columnName: RecipientAccountId
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SourceIpAddress
name: AWSCloudTrail - Policy version set to default
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Amazon%20Web%20Services/Analytic%20Rules/AWS_SetDefaulyPolicyVersion.yaml
triggerOperator: gt
status: Available
queryPeriod: 1h
requiredDataConnectors:
- connectorId: AWS
  dataTypes:
  - AWSCloudTrail
tactics:
- PrivilegeEscalation
query: |
  AWSCloudTrail
  | where EventName == "SetDefaultPolicyVersion" and isempty(ErrorCode) and isempty(ErrorMessage)
  | extend UserIdentityArn = iif(isempty(UserIdentityArn), tostring(parse_json(Resources)[0].ARN), UserIdentityArn)
  | extend UserName = tostring(split(UserIdentityArn, '/')[-1])
  | extend AccountName = case( UserIdentityPrincipalid == "Anonymous", "Anonymous", isempty(UserIdentityUserName), UserName, UserIdentityUserName)
  | extend AccountName = iif(AccountName contains "@", tostring(split(AccountName, '@', 0)[0]), AccountName),
    AccountUPNSuffix = iif(AccountName contains "@", tostring(split(AccountName, '@', 1)[0]), "")
description: |
  Detects SetDefaultPolicyVersion activity that makes a different IAM policy version active.
  Attackers can use this to activate previously created permissive versions and escalate access.
severity: Medium
id: 874a1762-3fd7-4489-b411-6d4a9e9e8a59
customDetails:
  UserIdentityArn: UserIdentityArn
  AWSRegion: AWSRegion
  EventName: EventName
  EventSource: EventSource
triggerThreshold: 0
queryFrequency: 1h
alertDetailsOverride:
  alertDescriptionFormat: Detected SetDefaultPolicyVersion from {{SourceIpAddress}} in account {{RecipientAccountId}}.
  alertDisplayNameFormat: AWS IAM default policy version changed by {{AccountName}}
version: 1.0.2
relevantTechniques:
- T1098.003

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/874a1762-3fd7-4489-b411-6d4a9e9e8a59')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/874a1762-3fd7-4489-b411-6d4a9e9e8a59')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Detected SetDefaultPolicyVersion from {{SourceIpAddress}} in account {{RecipientAccountId}}.",
          "alertDisplayNameFormat": "AWS IAM default policy version changed by {{AccountName}}"
        },
        "alertRuleTemplateName": "874a1762-3fd7-4489-b411-6d4a9e9e8a59",
        "customDetails": {
          "AWSRegion": "AWSRegion",
          "EventName": "EventName",
          "EventSource": "EventSource",
          "UserIdentityArn": "UserIdentityArn"
        },
        "description": "Detects SetDefaultPolicyVersion activity that makes a different IAM policy version active.\nAttackers can use this to activate previously created permissive versions and escalate access.\n",
        "displayName": "AWSCloudTrail - Policy version set to default",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountName",
                "identifier": "Name"
              },
              {
                "columnName": "AccountUPNSuffix",
                "identifier": "UPNSuffix"
              },
              {
                "columnName": "RecipientAccountId",
                "identifier": "CloudAppAccountId"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SourceIpAddress",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Amazon%20Web%20Services/Analytic%20Rules/AWS_SetDefaulyPolicyVersion.yaml",
        "query": "AWSCloudTrail\n| where EventName == \"SetDefaultPolicyVersion\" and isempty(ErrorCode) and isempty(ErrorMessage)\n| extend UserIdentityArn = iif(isempty(UserIdentityArn), tostring(parse_json(Resources)[0].ARN), UserIdentityArn)\n| extend UserName = tostring(split(UserIdentityArn, '/')[-1])\n| extend AccountName = case( UserIdentityPrincipalid == \"Anonymous\", \"Anonymous\", isempty(UserIdentityUserName), UserName, UserIdentityUserName)\n| extend AccountName = iif(AccountName contains \"@\", tostring(split(AccountName, '@', 0)[0]), AccountName),\n  AccountUPNSuffix = iif(AccountName contains \"@\", tostring(split(AccountName, '@', 1)[0]), \"\")\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [
          "T1098.003"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1098"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}