IAM Admin Policy Attached

Status: test
Severity: critical
Log source: product aws, service cloudtrail
Author: nishikawaakira (@nishikawaakira)
Source: github.com/Yamato-Security/suzaku-rules

Detects when an administrative IAM policy (AdministratorAccess, PowerUserAccess, or IAMFullAccess) is attached to a user, group, or role. This is a privilege escalation technique where an attacker elevates permissions of a compromised or newly created principal to gain full control of the AWS account.

Known false positives

Legitimate IAM administrators granting access during onboarding
Infrastructure-as-code deployments (Terraform, CloudFormation)

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1098.003` Account Manipulation: Additional Cloud Roles
Privilege Escalation	`T1098.003` Account Manipulation: Additional Cloud Roles

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `AttachGroupPolicy`: Attaches a managed IAM policy to an IAM group, granting the group's users the permissions defined in the policy.
AWS	CloudTrail event `AttachRolePolicy`: Attaches a managed IAM policy to an IAM role, adding the policy's permissions to the role.
AWS	CloudTrail event `AttachUserPolicy`: Attaches a managed IAM policy directly to an IAM user, granting that user the permissions defined in the policy.

Rules detecting the same action

These rules filter on the same operation.

AWS Compromised IAM Key Quarantine (Panther)
AWS IAM AdministratorAccess Policy Attached to Group (Elastic)
AWS IAM AdministratorAccess Policy Attached to Role (Elastic)
AWS IAM AdministratorAccess Policy Attached to User (Elastic)
AWS IAM Customer-Managed Policy Attached to Role by Rare User (Elastic)
AWS IAM Sensitive Operations via Lambda Execution Role (Elastic)
AWS Sensitive IAM Operations Performed via CloudShell (Elastic)
IAM Policy Attachment Attempt (Sigma)

Rule body

title: IAM Admin Policy Attached
id: 0a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: test
description: |
    Detects when an administrative IAM policy (AdministratorAccess,
    PowerUserAccess, or IAMFullAccess) is attached to a user, group, or role.
    This is a privilege escalation technique where an attacker elevates
    permissions of a compromised or newly created principal to gain full
    control of the AWS account.
references:
    - https://attack.mitre.org/techniques/T1098/003/
    - https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachUserPolicy.html
    - https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/
author: nishikawaakira (@nishikawaakira)
date: 2026-05-03
modified: 2026-05-29
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1098.003
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: iam.amazonaws.com
        eventName:
            - AttachUserPolicy
            - AttachGroupPolicy
            - AttachRolePolicy
    selection_admin:
        requestParameters.policyArn|contains:
            - AdministratorAccess
            - PowerUserAccess
            - IAMFullAccess
    filter:
        errorCode|exists: true
    condition: selection and selection_admin and not filter
falsepositives:
    - Legitimate IAM administrators granting access during onboarding
    - Infrastructure-as-code deployments (Terraform, CloudFormation)
level: critical

Stages and Predicates

Stage 0: `condition`

selection and selection_admin and not filter

Stage 1: `selection`

selection:
    eventSource: iam.amazonaws.com
    eventName:
        - AttachUserPolicy
        - AttachGroupPolicy
        - AttachRolePolicy

Stage 2: `selection_admin`

selection_admin:
    requestParameters.policyArn|contains:
        - AdministratorAccess
        - PowerUserAccess
        - IAMFullAccess

Stage 3: `not filter`

filter:
    errorCode|exists: true

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`errorCode`	is_not_null	(no value, null check)	`excludes:errorCode`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`AttachGroupPolicy` `AttachRolePolicy` `AttachUserPolicy`	`field:"aws::eventName" kind:eq`
`eventSource`	eq	`iam.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"iam.amazonaws.com"`
`requestParameters.policyArn`	match	`AdministratorAccess` `IAMFullAccess` `PowerUserAccess`	`field:"requestParameters.policyArn" kind:match`