Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

AWSCloudTrail - Privilege escalation with admin managed policy

Detects successful attachment of admin-related managed IAM policies to users, roles, or groups, excluding the dedicated AdministratorAccess and FullAccess patterns handled by other detections. This behavior may indicate unauthorized privilege escalation and should be validated against approved administrative changes.

ATT&CK coverage

Outside the enterprise matrix

T1098.003

Detection requirements

Log source product: aws
Log source service: awscloudtrail

What the source says

Tagged by the source as

PersistencePrivilegeEscalation

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.