IAM User added to an IAM group

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2025-11-12

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: AWS Audit Log
Detection Modules	Cloud
Detector Tags
ATT&CK Tactic	Privilege Escalation (TA0004) Persistence (TA0003)
ATT&CK Technique	Valid Accounts: Cloud Accounts (T1078.004) Account Manipulation: Additional Cloud Roles (T1098.003)
Severity	Informational

An IAM user was added to an IAM group.

Add a user to a group to establish persistence or escalate privileges within a cloud account.

Identify the identity that executed the API call.
Determine which IAM user was added to the group.
Evaluate the group's permissions to determine their applicability to the IAM user.