AWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Content Index


Identifies creation of IAM policies that grant broad IAM CRUD permissions, followed by attachment of that policy to a user, role, or group. This pattern may indicate an attempt to establish or expand privileged access and should be reviewed as potential privilege escalation.

Attribute Value
Type Analytic Rule
Solution Amazon Web Services
ID 8a607285-d95c-473d-8aab-59920de63af6
Severity Medium
Status Available
Kind Scheduled
Tactics DefenseEvasion, PrivilegeEscalation, Persistence
Techniques T1484, T1098.003
Required Connectors AWS
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Selection Criteria Transformations Ingestion API Lake-Only
AWSCloudTrail EventName in "AttachGroupPolicy,AttachRolePolicy,AttachUserPolicy,CreatePolicy,CreatePolicyVersion"

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Analytic Rules · Back to Amazon Web Services