Skip to content

Commit b01cfbf

Browse files
tradebot-elastictradebot-elastic
authored
Update latest docs (#7090)
1 parent 295a3d7 commit b01cfbf

File tree

58 files changed

+6181
-467
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

58 files changed

+6181
-467
lines changed

‎docs/detections/prebuilt-rules/downloadable-packages/8-19-9/prebuilt-rule-8-19-9-aws-iam-administratoraccess-policy-attached-to-group.asciidoc‎

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
[[prebuilt-rule-8-19-9-aws-iam-administratoraccess-policy-attached-to-group]]
2+
=== AWS IAM AdministratorAccess Policy Attached to Group
3+
4+
An adversary with access to a set of compromised credentials may attempt to persist or escalate privileges by attaching additional permissions to user groups the compromised user account belongs to. This rule looks for use of the IAM AttachGroupPolicy API operation to attach the highly permissive AdministratorAccess AWS managed policy to an existing IAM user group.
5+
6+
*Rule type*: eql
7+
8+
*Rule indices*:
9+
10+
* filebeat-*
11+
* logs-aws.cloudtrail-*
12+
13+
*Severity*: medium
14+
15+
*Risk score*: 47
16+
17+
*Runs every*: 5m
18+
19+
*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
20+
21+
*Maximum alerts per execution*: 100
22+
23+
*References*:
24+
25+
* https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachGroupPolicy.html
26+
* https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AdministratorAccess.html
27+
* https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/
28+
29+
*Tags*:
30+
31+
* Domain: Cloud
32+
* Data Source: AWS
33+
* Data Source: Amazon Web Services
34+
* Data Source: AWS IAM
35+
* Use Case: Identity and Access Audit
36+
* Tactic: Privilege Escalation
37+
* Tactic: Persistence
38+
* Resources: Investigation Guide
39+
40+
*Version*: 7
41+
42+
*Rule authors*:
43+
44+
* Elastic
45+
46+
*Rule license*: Elastic License v2
47+
48+
49+
==== Investigation guide
50+
51+
52+
53+
*Triage and analysis*
54+
55+
56+
> **Disclaimer**:
57+
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
58+
59+
60+
*Investigating AWS IAM AdministratorAccess Policy Attached to Group*
61+
62+
63+
The AWS-managed `AdministratorAccess` policy grants full administrative privileges across all AWS services.
64+
When attached to a group, all group members inherit this access, often unintentionally broadening the blast radius of a compromise.
65+
Adversaries can exploit `iam:AttachGroupPolicy` permissions to escalate privileges or establish persistence by attaching this policy to an existing user group.
66+
67+
68+
*Possible investigation steps*
69+
70+
71+
- **Identify the affected group and calling principal.**
72+
Review `aws.cloudtrail.user_identity.arn` (caller) and `aws.cloudtrail.request_parameters.groupName` (target group).
73+
Validate whether this aligns with legitimate change management or automation workflows.
74+
75+
- **Review group membership.**
76+
Enumerate current members using `aws iam get-group`.
77+
Determine whether unauthorized users could have gained administrative access as a result.
78+
79+
- **Inspect CloudTrail details.**
80+
Check `source.ip`, `user_agent.original`, and `source.geo` fields for anomalies.
81+
Compare with historical operations by the same principal.
82+
83+
- **Correlate related IAM activity.**
84+
Search for adjacent events such as `AddUserToGroup`, `CreateUser`, or `AttachUserPolicy`.
85+
These may indicate chained privilege escalation.
86+
87+
- **Assess propagation of privileges.**
88+
If the group has many members or is linked to cross-account roles, the impact may extend beyond a single user.
89+
Document all affected identities for containment.
90+
91+
92+
*False positive analysis*
93+
94+
95+
- **Intentional access updates.**
96+
Policy attachment may occur during legitimate administrative provisioning. Confirm via ticketing systems.
97+
- **Automation or compliance tasks.**
98+
Some environments use centralized scripts to attach AdministratorAccess temporarily. Validate through automation logs.
99+
100+
101+
*Response and remediation*
102+
103+
104+
**1. Immediate containment**
105+
- Detach the policy from the affected group (`aws iam detach-group-policy`).
106+
- Review and limit group membership. Temporarily remove non-essential users or disable access for impacted accounts.
107+
- Rotate credentials for users who inherited admin privileges from the attachment.
108+
- Enable MFA on all impacted accounts.
109+
110+
**2. Evidence preservation**
111+
- Export the triggering `AttachGroupPolicy` event and related CloudTrail entries ±30 minutes from the alert.
112+
- Preserve AWS Config and GuardDuty records to support forensic analysis.
113+
114+
**3. Scoping and investigation**
115+
- Review additional IAM operations from the same caller (`CreateAccessKey`, `AttachRolePolicy`, `UpdateAssumeRolePolicy`).
116+
- Identify whether new groups or roles were created shortly before or after the event.
117+
- Check for subsequent API activity by newly privileged users (for example, S3, EC2, or IAM modifications).
118+
119+
**4. Recovery and hardening**
120+
- Reinforce least privilege, avoid assigning `AdministratorAccess` to groups.
121+
- Use role-based access control with scoped permissions.
122+
- Enable CloudTrail, GuardDuty, and Security Hub across all regions.
123+
- Implement SCPs at the organization level to restrict direct `AdministratorAccess` attachments.
124+
125+
126+
*Additional information*
127+
128+
- **https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/[AWS IR Playbooks]: response steps related to IAM policy modification and unauthorized privilege escalation..
129+
- **https://github.com/aws-samples/aws-customer-playbook-framework/[AWS Customer Playbook Framework]: for containment, analysis, and recovery guidance.
130+
- **AWS Documentation:** https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html#jf_administrator[AdministratorAccess Policy].
131+
132+
133+
==== Rule query
134+
135+
136+
[source, js]
137+
----------------------------------
138+
iam where event.dataset == "aws.cloudtrail"
139+
and event.provider == "iam.amazonaws.com"
140+
and event.action == "AttachGroupPolicy"
141+
and event.outcome == "success"
142+
and stringContains(aws.cloudtrail.request_parameters, "policyArn=arn:aws:iam::aws:policy/AdministratorAccess")
143+
144+
----------------------------------
145+
146+
*Framework*: MITRE ATT&CK^TM^
147+
148+
* Tactic:
149+
** Name: Privilege Escalation
150+
** ID: TA0004
151+
** Reference URL: https://attack.mitre.org/tactics/TA0004/
152+
* Technique:
153+
** Name: Account Manipulation
154+
** ID: T1098
155+
** Reference URL: https://attack.mitre.org/techniques/T1098/
156+
* Sub-technique:
157+
** Name: Additional Cloud Roles
158+
** ID: T1098.003
159+
** Reference URL: https://attack.mitre.org/techniques/T1098/003/
160+
* Tactic:
161+
** Name: Persistence
162+
** ID: TA0003
163+
** Reference URL: https://attack.mitre.org/tactics/TA0003/
164+
* Technique:
165+
** Name: Account Manipulation
166+
** ID: T1098
167+
** Reference URL: https://attack.mitre.org/techniques/T1098/
168+
* Sub-technique:
169+
** Name: Additional Cloud Roles
170+
** ID: T1098.003
171+
** Reference URL: https://attack.mitre.org/techniques/T1098/003/

‎docs/detections/prebuilt-rules/downloadable-packages/8-19-9/prebuilt-rule-8-19-9-aws-iam-administratoraccess-policy-attached-to-role.asciidoc‎

Lines changed: 169 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,169 @@
1+
[[prebuilt-rule-8-19-9-aws-iam-administratoraccess-policy-attached-to-role]]
2+
=== AWS IAM AdministratorAccess Policy Attached to Role
3+
4+
An adversary with access to a set of compromised credentials may attempt to persist or escalate privileges by attaching additional permissions to compromised IAM roles. This rule looks for use of the IAM AttachRolePolicy API operation to attach the highly permissive AdministratorAccess AWS managed policy to an existing IAM role.
5+
6+
*Rule type*: eql
7+
8+
*Rule indices*:
9+
10+
* logs-aws.cloudtrail-*
11+
12+
*Severity*: medium
13+
14+
*Risk score*: 47
15+
16+
*Runs every*: 5m
17+
18+
*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
19+
20+
*Maximum alerts per execution*: 100
21+
22+
*References*:
23+
24+
* https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachRolePolicy.html
25+
* https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AdministratorAccess.html
26+
* https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/
27+
28+
*Tags*:
29+
30+
* Domain: Cloud
31+
* Data Source: AWS
32+
* Data Source: Amazon Web Services
33+
* Data Source: AWS IAM
34+
* Use Case: Identity and Access Audit
35+
* Tactic: Privilege Escalation
36+
* Tactic: Persistence
37+
* Resources: Investigation Guide
38+
39+
*Version*: 7
40+
41+
*Rule authors*:
42+
43+
* Elastic
44+
45+
*Rule license*: Elastic License v2
46+
47+
48+
==== Investigation guide
49+
50+
51+
52+
*Triage and analysis*
53+
54+
55+
> **Disclaimer**:
56+
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
57+
58+
59+
*Investigating AWS IAM AdministratorAccess Policy Attached to Role*
60+
61+
62+
The `AdministratorAccess` managed policy grants unrestricted privileges.
63+
When attached to a role, it can enable privilege escalation or persistence, especially if the role is assumable by other accounts or services.
64+
This rule detects `AttachRolePolicy` events where the `policyName` is `AdministratorAccess`.
65+
66+
67+
*Possible investigation steps*
68+
69+
70+
- **Identify both identities.**
71+
Determine the calling user or role (`aws.cloudtrail.user_identity.arn`) and the target role (`aws.cloudtrail.request_parameters.roleName`).
72+
Validate whether this change aligns with intended administrative actions.
73+
74+
- **Review the target role’s trust policy.**
75+
Examine who can assume the role (`AssumeRolePolicyDocument`).
76+
If the role is assumable by external accounts, this may indicate a potential persistence or lateral movement path.
77+
78+
- **Review CloudTrail details.**
79+
Check `source.ip`, `user_agent.original`, and `source.geo` fields for anomalies.
80+
Compare with historical operations by the same principal.
81+
82+
- **Correlate with adjacent IAM events.**
83+
Look for `UpdateAssumeRolePolicy`, `CreateAccessKey`, or `PassRole` calls.
84+
These often accompany privilege escalation activity.
85+
86+
- **Inspect downstream activity.**
87+
Query CloudTrail for recent `AssumeRole` calls for the target role — determine if the newly elevated permissions were used.
88+
89+
90+
*False positive analysis*
91+
92+
93+
- **Delegated role management.**
94+
Cloud administrators may legitimately grant temporary AdministratorAccess for troubleshooting. Confirm through tickets or change logs.
95+
- **Automation or service-linked roles.**
96+
Some services attach policies automatically for setup; verify whether the target is a service-linked role.
97+
98+
99+
*Response and remediation*
100+
101+
102+
**1. Immediate containment**
103+
- Detach the policy. Remove the `AdministratorAccess` policy from the target role.
104+
- Restrict access. Temporarily revoke the caller’s IAM privileges until the legitimacy of the action is confirmed.
105+
- Audit trust policies. Review the role’s trust relationships to ensure only approved principals can assume it.
106+
- Rotate credentials for any principals who assumed the affected role during the period of elevated privileges.
107+
108+
**2. Evidence preservation**
109+
- Export the triggering `AttachRolePolicy` event and related CloudTrail entries ±30 minutes from the alert.
110+
- Preserve AWS Config snapshots and GuardDuty findings for traceability.
111+
112+
**3. Scoping and investigation**
113+
- Identify if the elevated role was subsequently assumed.
114+
Correlate by matching `aws.cloudtrail.eventName:AssumeRole` with the target role ARN.
115+
- Search for other recent IAM policy attachments or modifications by the same actor or IP.
116+
117+
**4. Recovery and hardening**
118+
- Apply least privilege policies; limit who can attach or modify administrative policies.
119+
- Enforce IAM Conditions such as `aws:PrincipalArn` or `aws:ResourceTag` to limit policy attachment scope.
120+
- Enable CloudTrail, GuardDuty, and Security Hub across all regions.
121+
- Implement SCPs at the organization level to restrict direct `AdministratorAccess` attachments.
122+
123+
124+
*Additional information*
125+
126+
- **https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/[AWS IR Playbooks]: response steps related to IAM policy modification and unauthorized privilege escalation..
127+
- **https://github.com/aws-samples/aws-customer-playbook-framework/[AWS Customer Playbook Framework]: for containment, analysis, and recovery guidance.
128+
- **AWS Documentation:** https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html#jf_administrator[AdministratorAccess Policy].
129+
130+
131+
==== Rule query
132+
133+
134+
[source, js]
135+
----------------------------------
136+
iam where event.dataset == "aws.cloudtrail"
137+
and event.provider == "iam.amazonaws.com"
138+
and event.action == "AttachRolePolicy"
139+
and event.outcome == "success"
140+
and stringContains(aws.cloudtrail.request_parameters, "policyArn=arn:aws:iam::aws:policy/AdministratorAccess")
141+
142+
----------------------------------
143+
144+
*Framework*: MITRE ATT&CK^TM^
145+
146+
* Tactic:
147+
** Name: Privilege Escalation
148+
** ID: TA0004
149+
** Reference URL: https://attack.mitre.org/tactics/TA0004/
150+
* Technique:
151+
** Name: Account Manipulation
152+
** ID: T1098
153+
** Reference URL: https://attack.mitre.org/techniques/T1098/
154+
* Sub-technique:
155+
** Name: Additional Cloud Roles
156+
** ID: T1098.003
157+
** Reference URL: https://attack.mitre.org/techniques/T1098/003/
158+
* Tactic:
159+
** Name: Persistence
160+
** ID: TA0003
161+
** Reference URL: https://attack.mitre.org/tactics/TA0003/
162+
* Technique:
163+
** Name: Account Manipulation
164+
** ID: T1098
165+
** Reference URL: https://attack.mitre.org/techniques/T1098/
166+
* Sub-technique:
167+
** Name: Additional Cloud Roles
168+
** ID: T1098.003
169+
** Reference URL: https://attack.mitre.org/techniques/T1098/003/

0 commit comments

Comments
 (0)