Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

AWSCloudTrail - Privilege escalation with FullAccess managed policy

Detects successful attachment of AWS managed policies containing FullAccess permissions to users, roles, or groups, excluding admin-named policies. This action can rapidly expand privilege scope and should be reviewed as potential cloud privilege escalation.

ATT&CK coverage

Outside the enterprise matrix

T1098.003

Detection requirements

Log source product: aws
Log source service: awscloudtrail

What the source says

Tagged by the source as

PersistencePrivilegeEscalation

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.