Create aws_sts_assumedrole_misuse.yml

rules/cloud/aws_sts_assumedrole_misuse.yml

@@ -0,0 +1,29 @@
+title: AWS STS AssumedRole Misuse
+id: b45ab1d2-712f-4f01-a751-df3826969807
+description: Identifies the suspicious use of AssumedRole. Attackers could move laterally and escalate privileges.
+author: Austin Songer
+status: experimental
+date: 2021/07/24
+references:
+    - https://github.com/elastic/detection-rules/pull/1214
+    - https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html
+logsource:
+    service: cloudtrail
+detection:
+    selection_source:
+        - eventSource: sts.amazonaws.com
+    selection_eventname1:
+        - eventName: AssumedRole
+    selection_userrole:
+        - userIdentity.sessionContext: Role
+    condition: all of them
+level: low
+tags:
+  - attack.lateral_movement
+  - attack.privilege_escalation
+  - attack.t1548
+  - attack.t1550
+  - attack.t1550.001
+falsepositives:
+- AssumedRole may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. AssumedRole from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
+- Automated processes that uses Terraform may lead to false positives.