Detection rules › Sigma
IAM Policy Attachment Attempt
Detects a failed attempt to attach an IAM policy to a user, group, or role. Even though the attempt was denied, it indicates the attacker has valid credentials and is attempting privilege escalation. This is commonly observed when attackers use stolen credentials that lack IAM write permissions. Note: AccessDenied events may have empty requestParameters, so this rule does not filter by policy name to avoid missing detections.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Privilege Escalation | T1098.003 Account Manipulation: Additional Cloud Roles |
Event coverage
Rules detecting the same action
Other rules on this platform that filter on the same API call or operation.
- AWS Compromised IAM Key Quarantine (Panther)
- AWS IAM AdministratorAccess Policy Attached to Group (Elastic)
- AWS IAM AdministratorAccess Policy Attached to Role (Elastic)
- AWS IAM AdministratorAccess Policy Attached to User (Elastic)
- AWS IAM Customer-Managed Policy Attached to Role by Rare User (Elastic)
- AWS IAM Sensitive Operations via Lambda Execution Role (Elastic)
- AWS Sensitive IAM Operations Performed via CloudShell (Elastic)
- IAM Admin Policy Attached (Sigma)
Rule body yaml
title: IAM Policy Attachment Attempt
id: 0a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5e
status: test
description: |
Detects a failed attempt to attach an IAM policy to a user, group, or role.
Even though the attempt was denied, it indicates the attacker has valid
credentials and is attempting privilege escalation. This is commonly
observed when attackers use stolen credentials that lack IAM write
permissions.
Note: AccessDenied events may have empty requestParameters, so this rule
does not filter by policy name to avoid missing detections.
references:
- https://attack.mitre.org/techniques/T1098/003/
- https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachUserPolicy.html
- https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/
author: nishikawaakira (@nishikawaakira)
date: 2026-05-28
modified: 2026-05-29
tags:
- attack.privilege-escalation
- attack.t1098.003
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: iam.amazonaws.com
eventName:
- AttachUserPolicy
- AttachGroupPolicy
- AttachRolePolicy
errorCode: AccessDenied
condition: selection
falsepositives:
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
eventSource: iam.amazonaws.com
eventName:
- AttachUserPolicy
- AttachGroupPolicy
- AttachRolePolicy
errorCode: AccessDenied
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
errorCode | eq |
|
eventName | eq |
|
eventSource | eq |
|