aws-securityhub-recon-findings

Principal can enumerate Security Hub findings (securityhub:GetFindings), yielding a detailed inventory of every resource with a known vulnerability or misconfiguration - useful recon for target selection in lateral movement.

derived aws emits CanRead

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`SecurityService`
source	`?principal`
target	`?hub`
permissions	`securityhub:GetFindings`
conditions	`iam_permission`
state logic	ACTIVE if securityhub:GetFindings is in the principal's effective policy and no SCP or permission boundary denies it; BLOCKED if explicitly denied.

source type

Identity

target type

SecurityService

source

?principal

target

?hub

permissions

securityhub:GetFindings

conditions

iam_permission

state logic

ACTIVE if securityhub:GetFindings is in the principal's effective policy and no SCP or permission boundary denies it; BLOCKED if explicitly denied.

Narrative

{principal.name} can enumerate all AWS Security Hub findings (securityhub:GetFindings), gaining a comprehensive inventory of every resource with a known vulnerability, misconfiguration, or compliance failure in the account. Attackers use this as low-noise recon to identify high-value pivot targets (unencrypted S3 buckets, publicly-exposed instances, over-privileged roles) without triggering additional resource-level CloudTrail events.

Raw rule rules/derived/aws/securityhub.yaml

id: aws-securityhub-recon-findings
emits: CanRead
description: "Principal can enumerate Security Hub findings (securityhub:GetFindings), yielding a detailed\
  \ inventory of every resource with a known vulnerability or misconfiguration \u2014 useful recon for\
  \ target selection in lateral movement."
match:
- - principal: null
  - HasPermission
  - hub: null
where:
- node_type(?hub) == SecurityService
- node_class(?hub) == ManagementService
- ?hub.provider_type == 'AWS::SecurityHub::Hub'
- ?principal has EFFECTIVE securityhub:GetFindings on ?hub
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?hub
  permissions:
  - securityhub:GetFindings
  conditions:
  - iam_permission
  state_logic: ACTIVE if securityhub:GetFindings is in the principal's effective policy and no SCP or
    permission boundary denies it; BLOCKED if explicitly denied.
  confidence: 0.85
  derived_from:
  - ?principal HasPermission ?hub (securityhub:GetFindings effective)
  false_positive_note: "CanRead on a SecurityService node is low traversal weight (base_weight: 2) and\
    \ is a recon step, not an escalation. GetFindings is a read-only control-plane call that appears in\
    \ CloudTrail management events, not data events; it is present in the SecurityAudit and ReadOnlyAccess\
    \ managed policies. Do not conflate with access to the underlying resources described in the findings\
    \ \u2014 the findings describe a resource's configuration state, not the resource data itself. The\
    \ delegated admin can read findings from member accounts via the aggregation layer."
  narrative: '{principal.name} can enumerate all AWS Security Hub findings (securityhub:GetFindings),
    gaining a comprehensive inventory of every resource with a known vulnerability, misconfiguration,
    or compliance failure in the account. Attackers use this as low-noise recon to identify high-value
    pivot targets (unencrypted S3 buckets, publicly-exposed instances, over-privileged roles) without
    triggering additional resource-level CloudTrail events.'