{"id":"905d389b-b853-46d0-9d3d-dea0d3a3cd49","title":"AWS STS AssumeRole Misuse","description":"Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.","author":"Austin Songer @austinsonger","status":"test","level":"low","date":"2021-07-24","modified":"2022-10-09","tags":["attack.lateral-movement","attack.privilege-escalation","attack.t1548","attack.t1550","attack.t1550.001"],"technique_ids":["T1548","T1550","T1550.001"],"logsource":{"product":"aws","service":"cloudtrail"},"falsepositives":["AssumeRole may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.","AssumeRole from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.","Automated processes that uses Terraform may lead to false positives."],"references":["https://github.com/elastic/detection-rules/pull/1214","https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html"],"source_path":"rules/cloud/aws/cloudtrail/aws_sts_assumerole_misuse.yml","source_sha256":"6d5a489785cb83e1d7459733493874d0b18ecee6e76a155f932b0723504a5d78","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_sts_assumerole_misuse.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: AWS STS AssumeRole Misuse\nid: 905d389b-b853-46d0-9d3d-dea0d3a3cd49\nstatus: test\ndescription: Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.\nreferences:\n    - https://github.com/elastic/detection-rules/pull/1214\n    - https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html\nauthor: Austin Songer @austinsonger\ndate: 2021-07-24\nmodified: 2022-10-09\ntags:\n    - attack.lateral-movement\n    - attack.privilege-escalation\n    - attack.t1548\n    - attack.t1550\n    - attack.t1550.001\nlogsource:\n    product: aws\n    service: cloudtrail\ndetection:\n    selection:\n        userIdentity.type: AssumedRole\n        userIdentity.sessionContext.sessionIssuer.type: Role\n    condition: selection\nfalsepositives:\n    - AssumeRole may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n    - AssumeRole from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\n    - Automated processes that uses Terraform may lead to false positives.\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1548","id":"T1548","name":"Abuse Elevation Control Mechanism","page":"techniques/enterprise/T1548/"},{"key":"enterprise/T1550","id":"T1550","name":"Use Alternate Authentication Material","page":"techniques/enterprise/T1550/"},{"key":"enterprise/T1550.001","id":"T1550.001","name":"Application Access Token","page":"techniques/enterprise/T1550.001/"}],"data_path":"data/detection-rules/905d389b-b853-46d0-9d3d-dea0d3a3cd49.json","kind":"sigma"}