[metadata]
creation_date = "2020/07/16"
maturity = "production"
updated_date = "2020/10/26"

[rule]
author = ["Elastic"]
description = """
Identifies a high number of failed attempts to assume an AWS Identity and Access Management (IAM) role. IAM roles are
used to delegate access to users or services. An adversary may attempt to enumerate IAM roles in order to determine if a
role exists before attempting to assume or hijack the discovered role.
"""
from = "now-20m"
index = ["filebeat-*", "logs-aws*"]
language = "kuery"
license = "Elastic License"
name = "AWS IAM Brute Force of Assume Role Policy"
note = "The AWS Filebeat module must be enabled to use this rule."
references = [
    "https://www.praetorian.com/blog/aws-iam-assume-role-vulnerabilities",
    "https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/",
]
risk_score = 47
rule_id = "ea248a02-bc47-4043-8e94-2885b19b2636"
severity = "medium"
tags = ["Elastic", "Cloud", "AWS", "Continuous Monitoring", "SecOps", "Identity and Access"]
type = "threshold"

query = '''
event.dataset:aws.cloudtrail and
  event.provider:iam.amazonaws.com and event.action:UpdateAssumeRolePolicy and
  aws.cloudtrail.error_code:MalformedPolicyDocumentException and event.outcome:failure
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1110"
name = "Brute Force"
reference = "https://attack.mitre.org/techniques/T1110/"


[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[rule.threshold]
field = ""
value = 25

