AWS IAM privilege escalation
A change to AWS IAM that can grant or persist elevated access — attaching a policy, adding a user to a group, creating a new access key, or creating a…
What it detects
A change to AWS IAM that can grant or persist elevated access — attaching a policy, adding a user to a group, creating a new access key, or creating a console login profile. Attackers use these to escalate privilege and establish durable footholds after an initial compromise.
MITRE ATT&CK mapping
- T1098Account Manipulation· Persistence
False positives and triage
IAM changes are routine in automated provisioning. Distinguish human-initiated changes from CI/CD roles, and pay special attention to AdministratorAccess policy attachments and access keys created for other users.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 75%. Source: rules/cloud/aws_iam_privilege_escalation.yaml, licensed under the Apache License 2.0.
id: cloud.aws.iam_privilege_escalation
version: 1.1.0
status: stable
severity: high
confidence: 0.75
platforms: [application]
mitre_techniques: [T1098]
description: |
A change to AWS IAM that can grant or persist elevated access — attaching a policy,
adding a user to a group, creating a new access key, or creating a console login
profile. Attackers use these to escalate privilege and establish durable footholds after
an initial compromise.
match:
provider: AWS
event_action_any:
- AttachUserPolicy
- PutUserPolicy
- AttachRolePolicy
- AttachGroupPolicy
- CreateAccessKey
- CreateLoginProfile
- UpdateLoginProfile
- AddUserToGroup
- CreatePolicyVersion
- SetDefaultPolicyVersion
correlation_keys: [user_name]
false_positive_guidance: |
IAM changes are routine in automated provisioning. Distinguish human-initiated changes
from CI/CD roles, and pay special attention to AdministratorAccess policy attachments
and access keys created for other users.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.