AWS Setdefaultpolicyversion

AWS Setdefaultpolicyversion


This search looks for AWS CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy


AWS Setdefaultpolicyversion Help

You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.


Open in Search