This search looks for AWS CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy
AWS Setdefaultpolicyversion Help
You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
Open in Search