AWS CloudTrail: S3 Browser creates inline IAM policy with default bucket placeholder

title: "AWS CloudTrail: S3 Browser creates inline IAM policy with default bucket placeholder"
id: 850a45a6-2c78-4d4d-9c91-faf0cbd389e0
status: test
description: This rule identifies CloudTrail IAM PutUserPolicy events where the user agent contains "S3 Browser" and the request includes an inline policy referencing the default S3 bucket placeholder ARN value. Attackers can use templated or copy-pasted policies to quickly grant S3 permissions for persistence or access after gaining a foothold. The detection relies on CloudTrail IAM events, matching eventName=PutUserPolicy and specific requestParameters content indicative of the placeholder bucket and S3 GetObject allow statement.
references:
  - https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_iam_s3browser_templated_s3_bucket_policy_creation.yml
author: daniel.bohannon@permiso.io (@danielhbohannon), Huntrule Team
date: 2023-05-17
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.009
  - attack.persistence
  - attack.initial-access
  - attack.privilege-escalation
  - attack.t1078.004
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: iam.amazonaws.com
    eventName: PutUserPolicy
    userAgent|contains: S3 Browser
    requestParameters|contains|all:
      - '"arn:aws:s3:::<YOUR-BUCKET-NAME>/*"'
      - '"s3:GetObject"'
      - '"Allow"'
  condition: selection
falsepositives:
  - Valid usage of S3 browser with accidental creation of default Inline IAM policy without changing default S3 bucket name placeholder value
level: high
license: DRL-1.1
related:
  - id: db014773-7375-4f4e-b83b-133337c0ffee
    type: derived