# Cloud IAM Privilege Escalation

- **Severity:** Critical
- **Signature ID:** `ae1ca6c2-6700-5044-b8f0-f59f559f6609`
- **MITRE ATLAS:** AML.T0053 (AI Agent Tool Invocation), AML.TA0012 (Privilege Escalation)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI02 (Tool Misuse and Exploitation)

## Summary

This rule watches for cloud identity and access management actions that let someone gain more permissions than they started with, such as attaching new policies, assuming roles, or creating new credentials. These actions are normal parts of cloud administration, but they are also the standard toolkit attackers use once they get a foothold in a cloud account.

## How the attack works

An attacker who compromises a low-privilege cloud identity looks for IAM actions they can perform, such as attaching a more permissive policy to their own user or role, creating new access keys, or assuming a role with broader rights. Doing this turns limited initial access into broader control over the cloud environment without needing to exploit anything further. The rule flags this category of IAM operation regardless of whether it was performed legitimately or maliciously.

## Why it matters

If successful, an attacker moves from a minor foothold to controlling more cloud resources, potentially reaching data, infrastructure, or the ability to create persistent backdoor accounts.

## What you can do

- Apply least-privilege IAM policies so accounts cannot attach new policies or roles beyond what their job requires
- Require approval workflows or separate privileged accounts for policy attachment, role assumption, and credential creation
- Review IAM change history regularly and compare it against known infrastructure-as-code deployments to spot unexplained changes
- Alert on IAM changes made outside your normal deployment pipeline (e.g., Terraform, CloudFormation) or outside expected maintenance windows

## Known benign look-alikes

- Legitimate cloud infrastructure provisioning using IaC tools like Terraform or CloudFormation
- Authorised service account creation during application deployment

## References

- https://attack.mitre.org/techniques/T1548/
- https://attack.mitre.org/techniques/T1552/
- https://arxiv.org/abs/2403.04783

---
Source: https://www.netzilo.com/threats/cloud-iam-escalation