<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Detecting Cloud Privilege Escalation — API Reference

## AWS CloudTrail Events to Monitor

| Event Name | Risk | Description |
|------------|------|-------------|
| AttachUserPolicy | Critical | Policy attached to user |
| AttachRolePolicy | Critical | Policy attached to role |
| PutUserPolicy | High | Inline policy added to user |
| PutRolePolicy | High | Inline policy added to role |
| CreatePolicyVersion | High | New policy version created |
| CreateAccessKey | Critical | New access key for user |
| UpdateAssumeRolePolicy | Critical | Role trust policy modified |
| AddUserToGroup | High | User added to group |
| CreateLoginProfile | Medium | Console access created |
| PassRole | High | Role passed to service |

## AWS CLI Detection Commands

```bash
# Lookup specific event
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=EVENT_NAME \
  --start-time START --max-results 50

# Simulate policy
aws iam simulate-principal-policy --policy-source-arn ARN \
  --action-names "iam:AttachUserPolicy" "iam:PutUserPolicy"

# EventBridge rule for escalation
aws events put-rule --name NAME --event-pattern '{"source":["aws.iam"],"detail":{"eventName":["AttachUserPolicy"]}}'
```

## Azure Detection

```bash
# Role assignment changes
az monitor activity-log list --query "[?contains(operationName.value,'roleAssignments/write')]"

# Custom role changes
az monitor activity-log list --query "[?contains(operationName.value,'roleDefinitions/write')]"
```

## GCP Detection

```bash
# IAM policy changes
gcloud logging read 'protoPayload.methodName="SetIamPolicy"'

# Service account key creation
gcloud logging read 'protoPayload.methodName="google.iam.admin.v1.CreateServiceAccountKey"'
```

## Known Escalation Paths

| Provider | Path | Detection |
|----------|------|-----------|
| AWS | iam:AttachUserPolicy → admin policy | AttachUserPolicy event |
| AWS | iam:CreateAccessKey for other user | CreateAccessKey with different target |
| AWS | iam:UpdateAssumeRolePolicy | Trust policy changes |
| AWS | lambda:CreateFunction + iam:PassRole | CreateFunction with admin role |
| Azure | Role assignment to Owner | roleAssignments/write |
| GCP | setIamPolicy with roles/owner | SetIamPolicy audit log |
