Skip to content

Commit f97248a

Browse files
imays11imays11
committed
toml-lint
1 parent 3206386 commit f97248a

3 files changed

+69
-58
lines changed

‎rules/integrations/aws/privilege_escalation_iam_administratoraccess_policy_attached_to_group.toml‎

Lines changed: 24 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,16 @@ updated_date = "2025/10/13"
77
[rule]
88
author = ["Elastic"]
99
description = """
10-
An adversary with access to a set of compromised credentials may attempt to persist or escalate privileges by attaching additional permissions to user groups the compromised user account belongs to. This rule looks for use of the IAM AttachGroupPolicy API operation to attach the highly permissive AdministratorAccess AWS managed policy to an existing IAM user group.
10+
An adversary with access to a set of compromised credentials may attempt to persist or escalate privileges by attaching
11+
additional permissions to user groups the compromised user account belongs to. This rule looks for use of the IAM
12+
AttachGroupPolicy API operation to attach the highly permissive AdministratorAccess AWS managed policy to an existing
13+
IAM user group.
1114
"""
1215
false_positives = [
1316
"""
14-
While this can be normal behavior, it should be investigated to ensure validity. Verify whether the user identity should be using the IAM `AttachGroupPolicy` API operation to attach the `AdministratorAccess` policy to the user group.
17+
While this can be normal behavior, it should be investigated to ensure validity. Verify whether the user identity
18+
should be using the IAM `AttachGroupPolicy` API operation to attach the `AdministratorAccess` policy to the user
19+
group.
1520
""",
1621
]
1722
from = "now-6m"
@@ -87,7 +92,6 @@ Adversaries can exploit `iam:AttachGroupPolicy` permissions to escalate privileg
8792
- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/): for containment, analysis, and recovery guidance.
8893
- **AWS Documentation:** [AdministratorAccess Policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html#jf_administrator).
8994
"""
90-
9195
references = [
9296
"https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachGroupPolicy.html",
9397
"https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AdministratorAccess.html",
@@ -117,23 +121,6 @@ iam where event.dataset == "aws.cloudtrail"
117121
and stringContains(aws.cloudtrail.request_parameters, "policyArn=arn:aws:iam::aws:policy/AdministratorAccess")
118122
'''
119123

120-
[rule.investigation_fields]
121-
field_names = [
122-
"@timestamp",
123-
"user.name",
124-
"user_agent.original",
125-
"source.ip",
126-
"aws.cloudtrail.user_identity.arn",
127-
"aws.cloudtrail.user_identity.type",
128-
"aws.cloudtrail.user_identity.access_key_id",
129-
"event.action",
130-
"group.name",
131-
"event.outcome",
132-
"cloud.account.id",
133-
"cloud.region",
134-
"aws.cloudtrail.request_parameters"
135-
]
136-
137124

138125
[[rule.threat]]
139126
framework = "MITRE ATT&CK"
@@ -170,3 +157,20 @@ id = "TA0003"
170157
name = "Persistence"
171158
reference = "https://attack.mitre.org/tactics/TA0003/"
172159

160+
[rule.investigation_fields]
161+
field_names = [
162+
"@timestamp",
163+
"user.name",
164+
"user_agent.original",
165+
"source.ip",
166+
"aws.cloudtrail.user_identity.arn",
167+
"aws.cloudtrail.user_identity.type",
168+
"aws.cloudtrail.user_identity.access_key_id",
169+
"event.action",
170+
"group.name",
171+
"event.outcome",
172+
"cloud.account.id",
173+
"cloud.region",
174+
"aws.cloudtrail.request_parameters",
175+
]
176+

‎rules/integrations/aws/privilege_escalation_iam_administratoraccess_policy_attached_to_role.toml‎

Lines changed: 22 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,15 @@ updated_date = "2025/10/13"
77
[rule]
88
author = ["Elastic"]
99
description = """
10-
An adversary with access to a set of compromised credentials may attempt to persist or escalate privileges by attaching additional permissions to compromised IAM roles. This rule looks for use of the IAM AttachRolePolicy API operation to attach the highly permissive AdministratorAccess AWS managed policy to an existing IAM role.
10+
An adversary with access to a set of compromised credentials may attempt to persist or escalate privileges by attaching
11+
additional permissions to compromised IAM roles. This rule looks for use of the IAM AttachRolePolicy API operation to
12+
attach the highly permissive AdministratorAccess AWS managed policy to an existing IAM role.
1113
"""
1214
false_positives = [
1315
"""
14-
While this can be normal behavior, it should be investigated to ensure validity. Verify whether the user identity should be using the IAM `AttachRolePolicy` API operation to attach the `AdministratorAccess` policy to the target role.
16+
While this can be normal behavior, it should be investigated to ensure validity. Verify whether the user identity
17+
should be using the IAM `AttachRolePolicy` API operation to attach the `AdministratorAccess` policy to the target
18+
role.
1519
""",
1620
]
1721
from = "now-6m"
@@ -86,7 +90,6 @@ This rule detects `AttachRolePolicy` events where the `policyName` is `Administr
8690
- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/): for containment, analysis, and recovery guidance.
8791
- **AWS Documentation:** [AdministratorAccess Policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html#jf_administrator).
8892
"""
89-
9093
references = [
9194
"https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachRolePolicy.html",
9295
"https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AdministratorAccess.html",
@@ -116,22 +119,6 @@ iam where event.dataset == "aws.cloudtrail"
116119
and stringContains(aws.cloudtrail.request_parameters, "policyArn=arn:aws:iam::aws:policy/AdministratorAccess")
117120
'''
118121

119-
[rule.investigation_fields]
120-
field_names = [
121-
"@timestamp",
122-
"user.name",
123-
"user_agent.original",
124-
"source.ip",
125-
"aws.cloudtrail.user_identity.arn",
126-
"aws.cloudtrail.user_identity.type",
127-
"aws.cloudtrail.user_identity.access_key_id",
128-
"event.action",
129-
"event.outcome",
130-
"cloud.account.id",
131-
"cloud.region",
132-
"aws.cloudtrail.request_parameters"
133-
]
134-
135122

136123
[[rule.threat]]
137124
framework = "MITRE ATT&CK"
@@ -168,3 +155,19 @@ id = "TA0003"
168155
name = "Persistence"
169156
reference = "https://attack.mitre.org/tactics/TA0003/"
170157

158+
[rule.investigation_fields]
159+
field_names = [
160+
"@timestamp",
161+
"user.name",
162+
"user_agent.original",
163+
"source.ip",
164+
"aws.cloudtrail.user_identity.arn",
165+
"aws.cloudtrail.user_identity.type",
166+
"aws.cloudtrail.user_identity.access_key_id",
167+
"event.action",
168+
"event.outcome",
169+
"cloud.account.id",
170+
"cloud.region",
171+
"aws.cloudtrail.request_parameters",
172+
]
173+

‎rules/integrations/aws/privilege_escalation_iam_administratoraccess_policy_attached_to_user.toml‎

Lines changed: 23 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,15 @@ updated_date = "2025/10/13"
77
[rule]
88
author = ["Elastic"]
99
description = """
10-
An adversary with access to a set of compromised credentials may attempt to persist or escalate privileges by attaching additional permissions to compromised user accounts. This rule looks for use of the IAM AttachUserPolicy API operation to attach the highly permissive AdministratorAccess AWS managed policy to an existing IAM user.
10+
An adversary with access to a set of compromised credentials may attempt to persist or escalate privileges by attaching
11+
additional permissions to compromised user accounts. This rule looks for use of the IAM AttachUserPolicy API operation
12+
to attach the highly permissive AdministratorAccess AWS managed policy to an existing IAM user.
1113
"""
1214
false_positives = [
1315
"""
14-
While this can be normal behavior, it should be investigated to ensure validity. Verify whether the user identity should be using the IAM `AttachUserPolicy` API operation to attach the `AdministratorAccess` policy to the target user.
16+
While this can be normal behavior, it should be investigated to ensure validity. Verify whether the user identity
17+
should be using the IAM `AttachUserPolicy` API operation to attach the `AdministratorAccess` policy to the target
18+
user.
1519
""",
1620
]
1721
from = "now-6m"
@@ -92,7 +96,6 @@ This rule detects `AttachUserPolicy` events where the attached policy name is `A
9296
- **AWS Documentation:** [AdministratorAccess Policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html#jf_administrator).
9397
- **Security Best Practices:** [AWS Knowledge Center – Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/).
9498
"""
95-
9699
references = [
97100
"https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachUserPolicy.html",
98101
"https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AdministratorAccess.html",
@@ -122,22 +125,6 @@ iam where event.dataset == "aws.cloudtrail"
122125
and stringContains(aws.cloudtrail.request_parameters, "policyArn=arn:aws:iam::aws:policy/AdministratorAccess")
123126
'''
124127

125-
[rule.investigation_fields]
126-
field_names = [
127-
"@timestamp",
128-
"user.name",
129-
"user_agent.original",
130-
"source.ip",
131-
"aws.cloudtrail.user_identity.arn",
132-
"aws.cloudtrail.user_identity.type",
133-
"aws.cloudtrail.user_identity.access_key_id",
134-
"event.action",
135-
"user.target.name",
136-
"event.outcome",
137-
"cloud.account.id",
138-
"cloud.region",
139-
"aws.cloudtrail.request_parameters"
140-
]
141128

142129
[[rule.threat]]
143130
framework = "MITRE ATT&CK"
@@ -174,3 +161,20 @@ id = "TA0003"
174161
name = "Persistence"
175162
reference = "https://attack.mitre.org/tactics/TA0003/"
176163

164+
[rule.investigation_fields]
165+
field_names = [
166+
"@timestamp",
167+
"user.name",
168+
"user_agent.original",
169+
"source.ip",
170+
"aws.cloudtrail.user_identity.arn",
171+
"aws.cloudtrail.user_identity.type",
172+
"aws.cloudtrail.user_identity.access_key_id",
173+
"event.action",
174+
"user.target.name",
175+
"event.outcome",
176+
"cloud.account.id",
177+
"cloud.region",
178+
"aws.cloudtrail.request_parameters",
179+
]
180+

0 commit comments

Comments
 (0)