AnalysisType: rule
Filename: aws_iam_policy_modified.py
RuleID: "AWS.IAM.PolicyModified"
DisplayName: "IAM Policy Modified"
Enabled: true
LogTypes:
- AWS.CloudTrail
Tags:
- AWS
- Identity & Access Management
- Privilege Escalation:Abuse Elevation Control Mechanism
Reports:
CIS:
- 3.4
MITRE ATT&CK:
- TA0004:T1548
Stratus Red Team:
- aws.persistence.iam-create-admin-user
- aws.persistence.iam-create-backdoor-role
Severity: Info
DedupPeriodMinutes: 720 # 12 hours
Description: >
An IAM Policy was changed.
Runbook: https://docs.runpanther.io/alert-runbooks/built-in-rules/aws-iam-policy-modified
Reference: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html
SummaryAttributes:
- eventName
- userAgent
- sourceIpAddress
- recipientAccountId
- p_any_aws_arns
Tests:
- Name: IAM Policy Change
ExpectedResult: true
Log:
{
"eventVersion": "1.05",
"userIdentity":
{
"type": "AssumedRole",
"principalId": "1111:tester",
"arn": "arn:aws:sts::123456789012:assumed-role/tester",
"accountId": "123456789012",
"accessKeyId": "1",
"sessionContext":
{
"attributes":
{
"mfaAuthenticated": "true",
"creationDate": "2019-01-01T00:00:00Z",
},
"sessionIssuer":
{
"type": "Role",
"principalId": "1111",
"arn": "arn:aws:iam::123456789012:role/tester",
"accountId": "123456789012",
"userName": "tester",
},
},
},
"eventTime": "2019-01-01T00:00:00Z",
"eventSource": "iam.amazonaws.com",
"eventName": "DeleteGroupPolicy",
"awsRegion": "us-east-1",
"sourceIPAddress": "111.111.111.111",
"userAgent": "console.amazonaws.com",
"requestParameters": { "policyName": "policy", "groupName": "group" },
"responseElements": null,
"requestID": "1",
"eventID": "1",
"eventType": "AwsApiCall",
"recipientAccountId": "123456789012",
}
- Name: Not IAM Policy Change
ExpectedResult: false
Log:
{
"eventVersion": "1.06",
"userIdentity":
{
"type": "AssumedRole",
"principalId": "1111:tester",
"arn": "arn:aws:sts::123456789012:assumed-role/tester",
"accountId": "123456789012",
"accessKeyId": "1",
"sessionContext":
{
"sessionIssuer":
{
"type": "Role",
"principalId": "1111",
"arn": "arn:aws:iam::123456789012:role/tester",
"accountId": "123456789012",
"userName": "tester",
},
"attributes":
{
"creationDate": "2019-01-01T00:00:00Z",
"mfaAuthenticated": "true",
},
},
},
"eventTime": "2019-01-01T00:00:00Z",
"eventSource": "dynamodb.amazonaws.com",
"eventName": "DescribeTable",
"awsRegion": "us-west-2",
"sourceIPAddress": "111.111.111.111",
"userAgent": "console.amazonaws.com",
"requestParameters": { "tableName": "table" },
"responseElements": null,
"requestID": "1",
"eventID": "1",
"readOnly": true,
"resources":
[
{
"accountId": "123456789012",
"type": "AWS::DynamoDB::Table",
"ARN": "arn:aws:dynamodb:us-west-2:123456789012:table/table",
},
],
"eventType": "AwsApiCall",
"apiVersion": "2012-08-10",
"managementEvent": true,
"recipientAccountId": "123456789012",
}
- Name: IAM Policy Change Error
ExpectedResult: false
Log:
{
"eventVersion": "1.05",
"errorCode": "NoSuchEntity",
"userIdentity":
{
"type": "AssumedRole",
"principalId": "1111:tester",
"arn": "arn:aws:sts::123456789012:assumed-role/tester",
"accountId": "123456789012",
"accessKeyId": "1",
"sessionContext":
{
"attributes":
{
"mfaAuthenticated": "true",
"creationDate": "2019-01-01T00:00:00Z",
},
"sessionIssuer":
{
"type": "Role",
"principalId": "1111",
"arn": "arn:aws:iam::123456789012:role/tester",
"accountId": "123456789012",
"userName": "tester",
},
},
},
"eventTime": "2019-01-01T00:00:00Z",
"eventSource": "iam.amazonaws.com",
"eventName": "DeleteGroupPolicy",
"awsRegion": "us-east-1",
"sourceIPAddress": "111.111.111.111",
"userAgent": "console.amazonaws.com",
"requestParameters": { "policyName": "policy", "groupName": "group" },
"responseElements": null,
"requestID": "1",
"eventID": "1",
"eventType": "AwsApiCall",
"recipientAccountId": "123456789012",
}
# ------ paired body: aws_iam_policy_modified.py ------
from panther_aws_helpers import aws_cloudtrail_success, aws_rule_context
# API calls that are indicative of IAM Policy changes
POLICY_CHANGE_EVENTS = {
"DeleteGroupPolicy",
"DeleteRolePolicy",
"DeleteUserPolicy",
# Put<Entity>Policy is for inline policies.
# these can be moved into their own rule if inline policies are of a greater concern.
"PutGroupPolicy",
"PutRolePolicy",
"PutUserPolicy",
"CreatePolicy",
"DeletePolicy",
"CreatePolicyVersion",
"DeletePolicyVersion",
"AttachRolePolicy",
"DetachRolePolicy",
"AttachUserPolicy",
"DetachUserPolicy",
"AttachGroupPolicy",
"DetachGroupPolicy",
}
def rule(event):
return aws_cloudtrail_success(event) and event.get("eventName") in POLICY_CHANGE_EVENTS
def dedup(event):
return event.get("recipientAccountId")
def alert_context(event):
return aws_rule_context(event)