Aws-Iam

A detection rule by Elastic identifies potential privilege escalation within AWS environments by flagging when an AWS Identity and Access Management (IAM) customer-managed policy is attached to a role by an unusual or unauthorized user, indicating an attempt by an adversary to expand permissions, gain elevated access, or maintain persistence.

Adversaries with administrative access to an AWS account can create rogue SAML Identity Providers (IdPs) to establish persistent, federated access to AWS resources that survives credential rotation, enabling them to assume roles and access resources by forging SAML assertions from an IdP they control.