AWSCloudTrail - Privilege escalation with AdministratorAccess managed policy

Status: available
Severity: medium
Time window: 1d
Source: github.com/Azure/Azure-Sentinel

Detects successful attachment of the AWS managed AdministratorAccess policy to users, roles, or groups. This action can immediately grant full administrative permissions and is a high-risk privilege escalation pattern that should be validated against approved administrative activity.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1098.003` Account Manipulation: Additional Cloud Roles
Privilege Escalation	`T1098.003` Account Manipulation: Additional Cloud Roles

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `AttachGroupPolicy`: Attaches a managed IAM policy to an IAM group, granting the group's users the permissions defined in the policy.
AWS	CloudTrail event `AttachRolePolicy`: Attaches a managed IAM policy to an IAM role, adding the policy's permissions to the role.
AWS	CloudTrail event `AttachUserPolicy`: Attaches a managed IAM policy directly to an IAM user, granting that user the permissions defined in the policy.

Rules detecting the same action

These rules filter on the same operation.

Rule body

id: 139e7116-3884-4246-9978-c8f740770bdf
name: AWSCloudTrail - Privilege escalation with AdministratorAccess managed policy
description: |
  Detects successful attachment of the AWS managed AdministratorAccess policy to users, roles, or groups.
  This action can immediately grant full administrative permissions and is a high-risk privilege escalation pattern
  that should be validated against approved administrative activity.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: AWS
    dataTypes:
      - AWSCloudTrail
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - PrivilegeEscalation
  - Persistence
relevantTechniques:
  - T1098.003
query: |
  AWSCloudTrail
  | where  EventName in ("AttachUserPolicy","AttachRolePolicy","AttachGroupPolicy") and isempty(ErrorCode) and isempty(ErrorMessage)
  | where tostring(parse_json(RequestParameters).policyArn) startswith "arn:aws:iam::aws:policy/AdministratorAccess"
  | extend UserIdentityArn = iif(isempty(UserIdentityArn), tostring(parse_json(Resources)[0].ARN), UserIdentityArn)
  | extend UserName = tostring(split(UserIdentityArn, '/')[-1])
  | extend AccountName = case( UserIdentityPrincipalid == "Anonymous", "Anonymous", isempty(UserIdentityUserName), UserName, UserIdentityUserName)
  | extend AccountName = iif(AccountName contains "@", tostring(split(AccountName, '@', 0)[0]), AccountName),
    AccountUPNSuffix = iif(AccountName contains "@", tostring(split(AccountName, '@', 1)[0]), "")
  | project TimeGenerated, EventName, EventTypeName, UserIdentityAccountId, UserIdentityPrincipalid, UserAgent,UserIdentityUserName, SessionMfaAuthenticated, SourceIpAddress, AWSRegion, EventSource, AdditionalEventData, RequestParameters, UserIdentityArn, ResponseElements, RecipientAccountId, AccountName, AccountUPNSuffix
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: AccountUPNSuffix
      - identifier: CloudAppAccountId
        columnName: RecipientAccountId
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIpAddress
customDetails:
  EventName: EventName
  EventSource: EventSource
  AWSRegion: AWSRegion
  UserIdentityArn: UserIdentityArn
alertDetailsOverride:
  alertDisplayNameFormat: 'AWS AdministratorAccess policy attachment by {{AccountName}}'
  alertDescriptionFormat: 'Detected {{EventName}} from {{SourceIpAddress}} attaching AdministratorAccess in account {{RecipientAccountId}}.'
version: 1.0.2
kind: Scheduled

Stages and Predicates

Stage 1: `source`

AWSCloudTrail

Stage 2: `where`

| where  EventName in ("AttachUserPolicy","AttachRolePolicy","AttachGroupPolicy") and isempty(ErrorCode) and isempty(ErrorMessage)

Stage 3: `where`

| where tostring(parse_json(RequestParameters).policyArn) startswith "arn:aws:iam::aws:policy/AdministratorAccess"

Stage 4: `extend` (4 consecutive steps)

| extend UserIdentityArn = iif(isempty(UserIdentityArn), tostring(parse_json(Resources)[0].ARN), UserIdentityArn)
| extend UserName = tostring(split(UserIdentityArn, '/')[-1])
| extend AccountName = case( UserIdentityPrincipalid == "Anonymous", "Anonymous", isempty(UserIdentityUserName), UserName, UserIdentityUserName)
| extend AccountName = iif(AccountName contains "@", tostring(split(AccountName, '@', 0)[0]), AccountName),
  AccountUPNSuffix = iif(AccountName contains "@", tostring(split(AccountName, '@', 1)[0]), "")

Stage 5: `project`

| project TimeGenerated, EventName, EventTypeName, UserIdentityAccountId, UserIdentityPrincipalid, UserAgent,UserIdentityUserName, SessionMfaAuthenticated, SourceIpAddress, AWSRegion, EventSource, AdditionalEventData, RequestParameters, UserIdentityArn, ResponseElements, RecipientAccountId, AccountName, AccountUPNSuffix

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ErrorCode`	is_null	(no value, null check)	`field:"aws::errorCode" kind:is_null`
`ErrorMessage`	is_null	(no value, null check)	`field:"aws::errorMessage" kind:is_null`
`EventName`	in	`AttachGroupPolicy` `AttachRolePolicy` `AttachUserPolicy`	`field:"aws::eventName" kind:in`
`policyArn`	starts_with	`arn:aws:iam::aws:policy/AdministratorAccess` transforms: `tostring`	`field:"policyArn" kind:starts_with value:"arn:aws:iam::aws:policy/AdministratorAccess"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AWSRegion`	`project`
`AccountName`	`project`
`AccountUPNSuffix`	`project`
`AdditionalEventData`	`project`
`EventName`	`project`
`EventSource`	`project`
`EventTypeName`	`project`
`RecipientAccountId`	`project`
`RequestParameters`	`project`
`ResponseElements`	`project`
`SessionMfaAuthenticated`	`project`
`SourceIpAddress`	`project`
`TimeGenerated`	`project`
`UserAgent`	`project`
`UserIdentityAccountId`	`project`
`UserIdentityArn`	`project`
`UserIdentityPrincipalid`	`project`
`UserIdentityUserName`	`project`