An identity attached an administrative policy to an IAM user/role

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-09-24

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	Requires: AWS Audit Log
Detection Modules	Cloud
Detector Tags
ATT&CK Tactic	Privilege Escalation (TA0004)
ATT&CK Technique	Valid Accounts: Cloud Accounts (T1078.004)
Severity	Informational

An identity attached a highly privileged policy to an IAM user/role.

Escalate privileges in cloud environments.

Confirm whether this activity was intentional.
Check for other API calls that were executed by the identity.
Look for any suspicious behavior from the IAM user/role to whom the administrative policy was attached.

ATT&CK Tactic	Privilege Escalation (TA0004)
ATT&CK Technique	Valid Accounts: Cloud Accounts (T1078.004)
Severity	Low

An identity attached a highly privileged policy to an IAM user/role.

Escalate privileges in cloud environments.

Confirm whether this activity was intentional.
Check for other API calls that were executed by the identity.
Look for any suspicious behavior from the IAM user/role to whom the administrative policy was attached.

ATT&CK Tactic	Privilege Escalation (TA0004)
ATT&CK Technique	Valid Accounts: Cloud Accounts (T1078.004)
Severity	Medium

An identity attached a highly privileged policy to an IAM user/role.

Escalate privileges in cloud environments.

Confirm whether this activity was intentional.
Check for other API calls that were executed by the identity.
Look for any suspicious behavior from the IAM user/role to whom the administrative policy was attached.

ATT&CK Tactic	Privilege Escalation (TA0004)
ATT&CK Technique	Valid Accounts: Cloud Accounts (T1078.004)
Severity	Medium

An identity attached a highly privileged policy to an IAM user/role.

Escalate privileges in cloud environments.

Confirm whether this activity was intentional.
Check for other API calls that were executed by the identity.
Look for any suspicious behavior from the IAM user/role to whom the administrative policy was attached.