huntrule

Suspicious AWS IAM Privilege Escalation via AttachUserPolicy of Administrator Policy

PremiumReviewedSigma · High · v1
Product
aws
Service
cloudtrail
Author
HuntRule
Published
2026-05-17
Updated
2026-08-28
AnalysisDetection

ATT&CK techniques

Persistence → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects an IAM AttachUserPolicy call that attaches an administrator managed policy to a user, a technique used by operators of exposed IAM keys tracked by Unit 42 to escalate privileges before launching cryptojacking instances. Attackers abuse leaked long-term keys to grant themselves full control of the account which enables large scale resource abuse.

Reporting behind it

Related detections9 linkedT1098.003 — drag to rearrange
Suspicious Service Principal Creation via Azure Audit Logs
Malicious IAM Group Creation for SES Abuse by JavaGhost (via cloudtrail)
Malicious Administrator Policy Attachment for Privilege Escalation in AWS
Suspicious Azure Contributor Role Assignment to Identity
Malicious GCP Service Account Backdoor via serviceAccountTokenCreator Grant
Suspicious GCP Service Account Impersonation via GenerateAccessToken
Malicious Azure Elevate Access to User Access Administrator
Suspicious Azure Policy Definition or Assignment Modification
Suspicious AWS IAM Role Creation With Cross-Account Trust Policy
Suspicious AWS IAM Privilege Escalation via AttachUserPolicy of Administrator Policy
Pivot detection · T1098.003 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.