<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-iam-privilege-escalation
description: >-
  Detect and map AWS IAM privilege escalation paths including dangerous permission
  combinations, wildcard policies, and cross-account trust chain abuse.
domain: cybersecurity
subdomain: cloud-security
tags:
  - aws
  - iam
  - privilege-escalation
  - policy-analysis
  - cloudsplaining
  - boto3
  - least-privilege
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078.004", "T1548"]
---

# Detecting IAM Privilege Escalation

## Overview

AWS IAM privilege escalation occurs when a principal with limited permissions leverages
specific permission combinations to gain elevated access. This skill identifies known
escalation vectors — `iam:PassRole` + service creation, `iam:CreatePolicyVersion`,
`iam:AttachUserPolicy`, `sts:AssumeRole` trust chain abuse — and produces prioritized
findings with remediation steps.

Mode: `[MODE: PURPLE]` — Maps offensive escalation paths to defensive detections.

## Prerequisites

- AWS CLI v2 with configured credentials
- IAM permissions: `iam:GetAccountAuthorizationDetails`, `iam:ListUsers`, `iam:ListRoles`,
  `iam:ListPolicies`, `iam:GetPolicy`, `iam:GetPolicyVersion`
- Python 3.10+ with `boto3`
- Optional: `cloudsplaining` for HTML report generation

## Key Concepts

### Known Escalation Vectors

21 documented privilege escalation methods (Rhino Security Labs taxonomy):

| Vector | Permissions Required | Severity |
|--------|---------------------|----------|
| CreateNewPolicyVersion | `iam:CreatePolicyVersion` | Critical |
| SetExistingDefaultPolicyVersion | `iam:SetDefaultPolicyVersion` | Critical |
| CreateEC2WithExistingIP | `iam:PassRole`, `ec2:RunInstances` | High |
| CreateNewUser | `iam:CreateUser`, `iam:CreateLoginProfile` | High |
| CreateNewGroup | `iam:CreateGroup`, `iam:AttachGroupPolicy` | High |
| AttachUserPolicy | `iam:AttachUserPolicy` | Critical |
| AttachGroupPolicy | `iam:AttachGroupPolicy` | Critical |
| AttachRolePolicy | `iam:AttachRolePolicy` | Critical |
| PutUserPolicy | `iam:PutUserPolicy` | Critical |
| PutGroupPolicy | `iam:PutGroupPolicy` | Critical |
| PutRolePolicy | `iam:PutRolePolicy` | Critical |
| PassRoleLambda | `iam:PassRole`, `lambda:CreateFunction`, `lambda:InvokeFunction` | High |
| PassRoleCloudFormation | `iam:PassRole`, `cloudformation:CreateStack` | High |
| UpdateRoleTrust | `iam:UpdateAssumeRolePolicy` | Critical |
| PassRoleDataPipeline | `iam:PassRole`, `datapipeline:CreatePipeline` | High |
| PassRoleGlue | `iam:PassRole`, `glue:CreateDevEndpoint` | High |
| UpdateLoginProfile | `iam:UpdateLoginProfile` | High |
| PassRoleSageMaker | `iam:PassRole`, `sagemaker:CreateNotebookInstance` | High |
| PassRoleSSM | `iam:PassRole`, `ssm:StartSession` | High |
| EditExistingLambdaWithRole | `lambda:UpdateFunctionCode` | High |
| CodeStarCreateProject | `codestar:CreateProject` | High |

### Policy Analysis Methodology

```bash
# Download full IAM authorization details
aws iam get-account-authorization-details > /tmp/iam_authz.json

# Analyze with cloudsplaining
cloudsplaining download --output /tmp/iam_authz.json
cloudsplaining scan --input-file /tmp/iam_authz.json --output /tmp/cloudsplaining_report/
```

### Dangerous Permission Patterns

```bash
# Find policies with iam:* actions
cat /tmp/iam_authz.json | jq -r '
  .Policies[] |
  select(.PolicyVersionList[].Document.Statement[] |
    select(.Effect == "Allow") |
    .Action // [] | .[] |
    test("^iam:\\*$|^iam:Create|^iam:Attach|^iam:Put|^iam:PassRole"))
  | .PolicyName'

# Find roles with wildcard resource
cat /tmp/iam_authz.json | jq -r '
  .RoleDetailList[] |
  select(.AttachedManagedPolicies[].PolicyName == "AdministratorAccess")
  | .RoleName'
```

### CloudTrail Detection Rules

Monitor for privilege escalation attempts in CloudTrail:

```bash
# Search for CreatePolicyVersion events
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=CreatePolicyVersion \
  --start-time "2026-03-01T00:00:00Z"

# Search for AttachUserPolicy events
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=AttachUserPolicy \
  --start-time "2026-03-01T00:00:00Z"
```

## Workflow

### Step 1: Collect IAM Data

```bash
aws iam get-account-authorization-details \
  --output json > /tmp/iam_authz.json
aws iam generate-credential-report
aws iam get-credential-report --output text --query Content | base64 -d > /tmp/cred_report.csv
```

### Step 2: Run Escalation Scanner

```bash
node scripts/agent.js --input /tmp/iam_authz.json --output /tmp/privesc_findings.json
```

### Step 3: Review Findings

```bash
# Show critical findings
cat /tmp/privesc_findings.json | jq '.findings[] | select(.severity == "critical")'

# Count by severity
cat /tmp/privesc_findings.json | jq '[.findings[] | .severity] | group_by(.) | map({(.[0]): length}) | add'
```

### Step 4: Remediate

Apply least-privilege policies, add permission boundaries, and enable CloudTrail alerts
for IAM modification events.

## Detection

```yaml
title: Iam Privilege Escalation Detection
id: 5d2309b3-8ad9-4b85-9b88-ccecc0977dcb
status: experimental
description: Detects suspicious activity related to detecting iam privilege escalation techniques in cloud security context
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1078.004
  - attack.t1548
  - attack.credential_access
falsepositives:
  - Automated cloud infrastructure provisioning by approved CI/CD pipelines
```

## Verification

- [ ] No principals with `iam:*` on `Resource: *`
- [ ] No policies allowing `iam:CreatePolicyVersion` without condition constraints
- [ ] Permission boundaries applied to all human IAM users
- [ ] CloudTrail alerting on IAM modification events
- [ ] `iam:PassRole` restricted to specific role ARNs (not `*`)
- [ ] Cross-account role trust policies use `aws:PrincipalOrgID`
- [ ] No unused IAM roles with elevated permissions

## References

- [Rhino Security Labs — AWS IAM Privilege Escalation Methods](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/)
- [MITRE ATT&CK T1078.004 — Valid Accounts: Cloud Accounts](https://attack.mitre.org/techniques/T1078/004/)
- [AWS IAM Access Analyzer](https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html)
- [Cloudsplaining — AWS IAM Assessment Tool](https://github.com/salesforce/cloudsplaining)
