AWS Backdoor Administrative IAM Role Created

Description

Identifies when CreateRole and AttachAdminRolePolicy CloudTrail events occur in a short period of time. This sequence could indicate a potential security breach.

Query

Detection:
    - Group:
        - ID: CreateRole
          RuleID: AWS.IAM.CreateRole
        - ID: AttachAdminRolePolicy
          RuleID: AWS.IAM.AttachAdminRolePolicy
      MatchCriteria:
        field_name:
          - GroupID: CreateRole
            Match: p_alert_context.request_rolename
          - GroupID: AttachAdminRolePolicy
            Match: p_alert_context.request_rolename
      LookbackWindowMinutes: 1800
      Schedule:
        RateMinutes: 1440
        TimeoutMinutes: 5

Rule dependencies

⚠ Higher-order rule. It fires on other rules' alerts, not on raw events, so it cannot fire on its own. Deploy the rules it depends on too.

Depends on

Raw source AWS Backdoor Administrative IAM Role Created · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: correlation_rule
RuleID: "AWS.Backdoor.Administrative.IAM.Role.Created.Group"
DisplayName: "AWS Backdoor Administrative IAM Role Created"
Enabled: false
Severity: High
Description: Identifies when CreateRole and AttachAdminRolePolicy CloudTrail events occur in a short period of time. This sequence could indicate a potential security breach.
Reference: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html
Reports:
  MITRE ATT&CK:
    - TA0007:T1078
Detection:
    - Group:
        - ID: CreateRole
          RuleID: AWS.IAM.CreateRole
        - ID: AttachAdminRolePolicy
          RuleID: AWS.IAM.AttachAdminRolePolicy
      MatchCriteria:
        field_name:
          - GroupID: CreateRole
            Match: p_alert_context.request_rolename
          - GroupID: AttachAdminRolePolicy
            Match: p_alert_context.request_rolename
      LookbackWindowMinutes: 1800
      Schedule:
        RateMinutes: 1440
        TimeoutMinutes: 5
Tests:
    - Name: Role Created, Followed By Policy Attachment
      ExpectedResult: true
      RuleOutputs:
        - ID: CreateRole
          Matches:
            p_alert_context.request_rolename:
              'new-role':
                - "2024-06-01T10:00:01Z"
        - ID: AttachAdminRolePolicy
          Matches:
            p_alert_context.request_rolename:
              'new-role':
                - "2024-06-01T10:30:01Z"
    - Name: Role Created, Not Followed By Policy Attachment
      ExpectedResult: false
      RuleOutputs:
        - ID: CreateRole
          Matches:
            p_alert_context.request_rolename:
              'new-role':
                - "2024-06-01T10:00:01Z"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.