AWS Setdefaultpolicyversion

AWS Setdefaultpolicyversion

Description

This search looks for AWS CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy

   Help

AWS Setdefaultpolicyversion Help

You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.

   Search

Open in Search