AWSCloudTrail - Creation of SSM policy and then privilege escalation

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Content Index


Identifies creation of IAM policies that grant broad AWS Systems Manager permissions followed by attachment to a user, role, or group. This sequence can indicate an attempt to gain administration capabilities that support privilege escalation.

Attribute Value
Type Analytic Rule
Solution Amazon Web Services
ID aaa2c05e-fdd4-4fa0-9072-6cffe3641b34
Severity Medium
Status Available
Kind Scheduled
Tactics DefenseEvasion, PrivilegeEscalation, Persistence
Techniques T1484, T1098.003
Required Connectors AWS
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Transformations Ingestion API Lake-Only
AWSCloudTrail

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Analytic Rules · Back to Amazon Web Services