Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

AWSCloudTrail - Creation of Glue policy and then privilege escalation

Identifies creation of IAM policies that grant broad AWS Glue permissions paired with IAM permissions, followed by policy attachment to a principal. This sequence can indicate unauthorized privilege expansion and should be reviewed for potential cloud account manipulation.

ATT&CK coverage

Persistence

T1098Account ManipulationAlso under Privilege Escalation.
- T1098.003Additional Cloud Roles 85 detections cover this technique

Privilege Escalation

T1484Domain or Tenant Policy ModificationAlso under Defense Impairment.57 detections cover this technique

Detection requirements

Log source product: aws
Log source service: awscloudtrail

What the source says

Tagged by the source as

DefenseEvasionPersistencePrivilegeEscalation

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.