<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-cloud-privilege-escalation
description: >-
  Detect cloud privilege escalation attacks across AWS, Azure, and GCP by monitoring
  IAM policy changes, role assumption patterns, permission boundary bypasses, and
  known escalation paths through misconfigured policies.
domain: cybersecurity
subdomain: cloud-security
tags:
  - aws
  - azure
  - gcp
  - privilege-escalation
  - iam
  - cloudtrail
  - threat-detection
  - role-assumption
  - policy-modification
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1548"]
---

# Detecting Cloud Privilege Escalation

## Overview

Cloud privilege escalation occurs when an attacker with limited access exploits IAM
misconfigurations to gain higher privileges. Common paths include attaching admin
policies to controlled roles, creating new access keys for privileged users, modifying
trust policies for cross-account assumption, and exploiting Lambda/CloudFormation
service roles. This skill provides detection for known escalation techniques across
AWS, Azure, and GCP using audit log analysis and proactive misconfiguration scanning.

Mode: `[MODE: BLUE]` with `[MODE: PURPLE]` layer — Detection engineering for privilege escalation.

## Prerequisites

| Requirement | Details |
|---|---|
| AWS CLI v2, Azure CLI, `gcloud` CLI configured | Required |
| AWS | CloudTrail enabled, `cloudtrail:LookupEvents`, `iam:Simulate*` permissions |
| Azure | Activity Log access, `Security Reader` role |
| GCP | Admin Activity audit logs enabled |
| Python 3.10+ with `boto3` | Required |

## Key Concepts

### AWS Privilege Escalation Detection

```bash
# Detect IAM policy attachment events
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=AttachUserPolicy \
  --start-time $(date -u -d '24 hours ago' +%Y-%m-%dT%H:%M:%S) \
  --query 'Events[].{Time:EventTime,User:Username,Event:EventName}'

# Detect inline policy creation (potential escalation)
for event in PutUserPolicy PutRolePolicy PutGroupPolicy CreatePolicy CreatePolicyVersion; do
  aws cloudtrail lookup-events \
    --lookup-attributes AttributeKey=EventName,AttributeValue=$event \
    --start-time $(date -u -d '24 hours ago' +%Y-%m-%dT%H:%M:%S) \
    --query "Events[].{Time:EventTime,User:Username,Event:EventName}" --output table
done

# Detect access key creation for other users
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=CreateAccessKey \
  --start-time $(date -u -d '24 hours ago' +%Y-%m-%dT%H:%M:%S) | \
  jq '.Events[].CloudTrailEvent | fromjson |
    select(.requestParameters.userName != .userIdentity.userName) |
    {actor: .userIdentity.arn, targetUser: .requestParameters.userName}'

# Detect role trust policy modification
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=UpdateAssumeRolePolicy \
  --start-time $(date -u -d '24 hours ago' +%Y-%m-%dT%H:%M:%S) \
  --query 'Events[].{Time:EventTime,User:Username}'

# Detect Lambda function creation (potential escalation via service role)
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=CreateFunction20150331 \
  --start-time $(date -u -d '24 hours ago' +%Y-%m-%dT%H:%M:%S) | \
  jq '.Events[].CloudTrailEvent | fromjson | {actor: .userIdentity.arn, functionRole: .requestParameters.role}'

# Find IAM users who can escalate (proactive)
aws iam simulate-principal-policy \
  --policy-source-arn $USER_ARN \
  --action-names "iam:AttachUserPolicy" "iam:PutUserPolicy" "iam:CreateAccessKey" "iam:UpdateAssumeRolePolicy" \
  --query 'EvaluationResults[?EvalDecision==`allowed`].{Action:EvalActionName}'
```

### Azure Privilege Escalation Detection

```bash
# Detect role assignment changes
az monitor activity-log list \
  --start-time $(date -u -d '24 hours ago' +%Y-%m-%dT%H:%M:%SZ) \
  --query "[?contains(operationName.value,'roleAssignments/write')].{Caller:caller,Time:eventTimestamp,Status:status.value}" \
  --output table

# Detect custom role creation/modification
az monitor activity-log list \
  --start-time $(date -u -d '24 hours ago' +%Y-%m-%dT%H:%M:%SZ) \
  --query "[?contains(operationName.value,'roleDefinitions/write')].{Caller:caller,Time:eventTimestamp}" \
  --output table

# Detect PIM role activation
az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/auditLogs/directoryAudits?\$filter=activityDisplayName eq 'Add member to role completed (PIM activation)'" \
  --query "value[].{Actor:initiatedBy.user.userPrincipalName,Target:targetResources[0].displayName,Time:activityDateTime}"
```

### GCP Privilege Escalation Detection

```bash
# Detect IAM policy changes
gcloud logging read 'protoPayload.methodName="SetIamPolicy" AND severity>=NOTICE' \
  --limit=50 --format="table(timestamp,protoPayload.authenticationInfo.principalEmail,resource.type)"

# Detect service account key creation
gcloud logging read 'protoPayload.methodName="google.iam.admin.v1.CreateServiceAccountKey"' \
  --limit=50 --format=json

# Detect service account impersonation
gcloud logging read 'protoPayload.methodName="GenerateAccessToken" OR protoPayload.methodName="SignBlob"' \
  --limit=50 --format="table(timestamp,protoPayload.authenticationInfo.principalEmail)"
```

## Workflow

### Step 1: Deploy Detection Rules

```bash
# AWS — create EventBridge rule for IAM escalation events
aws events put-rule --name "IAMPrivilegeEscalation" \
  --event-pattern '{
    "source": ["aws.iam"],
    "detail-type": ["AWS API Call via CloudTrail"],
    "detail": {
      "eventName": ["AttachUserPolicy","AttachRolePolicy","PutUserPolicy","PutRolePolicy",
                     "CreateAccessKey","UpdateAssumeRolePolicy","CreatePolicyVersion"]
    }
  }'
```

### Step 2: Run Detection Script

```bash
node scripts/agent.js --provider aws --hours 24 --output /tmp/privesc_detection.json
```

## Detection

```yaml
title: Cloud Privilege Escalation Detection
id: 7f4ac143-7ab5-4ef0-9553-2ab8ab5d4e0b
status: experimental
description: Detects suspicious activity related to detecting cloud privilege escalation techniques in cloud security context
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1548
  - attack.credential_access
falsepositives:
  - Automated cloud infrastructure provisioning by approved CI/CD pipelines
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Cloud Privilege Escalation Detection | aws | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1548 |

## Verification

- [ ] CloudTrail/audit logs capture all IAM modification events
- [ ] Alerting rules deployed for known escalation API calls
- [ ] Permission boundaries prevent self-escalation
- [ ] IAM policy simulation identifies exploitable paths
- [ ] EventBridge/Log-based alerts trigger on privilege changes
- [ ] Service role creation monitored for overprivileged assignments
- [ ] Cross-account role trust policies regularly reviewed

## References

- [MITRE ATT&CK T1098 — Account Manipulation](https://attack.mitre.org/techniques/T1098/)
- [MITRE ATT&CK T1078.004 — Cloud Accounts](https://attack.mitre.org/techniques/T1078/004/)
- [AWS IAM Privilege Escalation Methods (Rhino Security)](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/)
- [GCP Privilege Escalation](https://about.gitlab.com/blog/2020/02/12/plundering-gcp-escalating-privileges-in-google-cloud-platform/)
