Skip to content
Threat Feed
Subscribe
medium advisory

Detection of Unusual AWS IAM Guardrail Policy Deletion

This threat brief identifies a detection strategy for attackers attempting defense evasion or persistence by deleting sensitive AWS IAM managed policies using previously unseen identities.

Adversaries with elevated privileges often seek to impair security controls or establish persistent access by modifying identity structures. In AWS environments, this frequently involves deleting IAM managed policies that act as permissions boundaries or guardrails (e.g., policies containing "Boundary", "Deny", "Restrict", or "Guardrail"). By removing these restrictive policies, attackers can silently expand their effective permissions across the account.

This activity is often performed after initial access and privilege escalation. Defenders should be alerted when an identity performs this deletion for the first time in a 7-day period, as this behavioral anomaly may signify the use of compromised credentials or unauthorized administrative actions. Infrastructure-as-code (IaC) tools such as Terraform, CloudFormation, Pulumi, and Ansible are excluded from this detection logic to differentiate routine automated configuration changes from potentially malicious activity.

Impact

Successful exploitation of this technique leads to the degradation of the account's security posture. By deleting permission boundaries or deny-based policies, an attacker can bypass intended access constraints, potentially escalating privileges, accessing sensitive data, or establishing long-term persistence within the environment. If unchecked, this can facilitate large-scale unauthorized data access or complete account takeover.

Recommendation

Prioritize the following actions to detect and mitigate unauthorized IAM modifications:

  • Deploy the provided Sigma rule to your SIEM to monitor for 'DeletePolicy' events originating from unexpected identities.
  • Investigate any 'DeletePolicy' event involving a policy ARN containing guardrail-related keywords (Boundary, Deny, Restrict, Guard, SCP, Guardrail).
  • Cross-reference the identified principal's activity with other privilege escalation indicators such as 'CreatePolicyVersion', 'AttachRolePolicy', or 'UpdateAssumeRolePolicy'.
  • Verify that the IAM identity responsible for the policy deletion is an authorized management role and not an unexpected or recently assumed principal.

Detection coverage 1

Detect Unusual Deletion of AWS IAM Guardrail Policies

medium

Detects the first time an AWS identity successfully deletes an IAM managed policy containing guardrail-related keywords, potentially indicating defense evasion or privilege escalation.

sigma tactics: defense_evasion, persistence techniques: T1098, T1562 sources: cloud, aws

Detection queries are available on the platform. Get full rules →