AWSCloudTrail - Privilege escalation via CRUD IAM policy

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Content Index


Detects creation of inline IAM policies that grant broad IAM create, read, update, and delete capabilities. This behavior can establish or expand privileged control paths in the account and should be reviewed as potential privilege escalation.

Attribute Value
Type Analytic Rule
Solution Amazon Web Services
ID e20d35a3-4fec-4c8b-81b1-fc33b41990b0
Severity Medium
Status Available
Kind Scheduled
Tactics PrivilegeEscalation
Techniques T1098.003
Required Connectors AWS
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Selection Criteria Transformations Ingestion API Lake-Only
AWSCloudTrail EventName in "PutGroupPolicy,PutRolePolicy,PutUserPolicy"

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Analytic Rules · Back to Amazon Web Services