IAM Policy Attachment Attempt

Status: test
Severity: medium
Log source: product aws, service cloudtrail
Author: nishikawaakira (@nishikawaakira)
Source: github.com/Yamato-Security/suzaku-rules

Detects a failed attempt to attach an IAM policy to a user, group, or role. Even though the attempt was denied, it indicates the attacker has valid credentials and is attempting privilege escalation. This is commonly observed when attackers use stolen credentials that lack IAM write permissions. Note: AccessDenied events may have empty requestParameters, so this rule does not filter by policy name to avoid missing detections.

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1098.003` Account Manipulation: Additional Cloud Roles

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `AttachGroupPolicy`: Attaches a managed IAM policy to an IAM group, granting the group's users the permissions defined in the policy.
AWS	CloudTrail event `AttachRolePolicy`: Attaches a managed IAM policy to an IAM role, adding the policy's permissions to the role.
AWS	CloudTrail event `AttachUserPolicy`: Attaches a managed IAM policy directly to an IAM user, granting that user the permissions defined in the policy.

Rules detecting the same action

These rules filter on the same operation.

AWS Compromised IAM Key Quarantine (Panther)
AWS IAM AdministratorAccess Policy Attached to Group (Elastic)
AWS IAM AdministratorAccess Policy Attached to Role (Elastic)
AWS IAM AdministratorAccess Policy Attached to User (Elastic)
AWS IAM Customer-Managed Policy Attached to Role by Rare User (Elastic)
AWS IAM Sensitive Operations via Lambda Execution Role (Elastic)
AWS Sensitive IAM Operations Performed via CloudShell (Elastic)
IAM Admin Policy Attached (Sigma)

Rule body

title: IAM Policy Attachment Attempt
id: 0a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5e
status: test
description: |
    Detects a failed attempt to attach an IAM policy to a user, group, or role.
    Even though the attempt was denied, it indicates the attacker has valid
    credentials and is attempting privilege escalation. This is commonly
    observed when attackers use stolen credentials that lack IAM write
    permissions.
    Note: AccessDenied events may have empty requestParameters, so this rule
    does not filter by policy name to avoid missing detections.
references:
    - https://attack.mitre.org/techniques/T1098/003/
    - https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachUserPolicy.html
    - https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/
author: nishikawaakira (@nishikawaakira)
date: 2026-05-28
modified: 2026-05-29
tags:
    - attack.privilege-escalation
    - attack.t1098.003
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: iam.amazonaws.com
        eventName:
            - AttachUserPolicy
            - AttachGroupPolicy
            - AttachRolePolicy
        errorCode: AccessDenied
    condition: selection
falsepositives:
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    eventSource: iam.amazonaws.com
    eventName:
        - AttachUserPolicy
        - AttachGroupPolicy
        - AttachRolePolicy
    errorCode: AccessDenied

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`errorCode`	eq	`AccessDenied`	`field:"aws::errorCode" kind:eq value:"AccessDenied"`
`eventName`	eq	`AttachGroupPolicy` `AttachRolePolicy` `AttachUserPolicy`	`field:"aws::eventName" kind:eq`
`eventSource`	eq	`iam.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"iam.amazonaws.com"`