Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access T1548.005

Tactic: Privilege Escalation

Adversaries may abuse permission configurations that allow them to gain temporarily elevated access to cloud resources. Many cloud environments allow administrators to grant user or service accounts permission to request just-in-time access to roles, impersonate other accounts, pass roles onto resources and services, or otherwise gain short-term access to a set of privileges that may be distinct from their own.

Authoring guide

These 7 rules share fields, values, and exclusions.

Fields filtered most (8 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
EventType7eq 5, in 2associateiaminstanceprofile, assumerole, assumeroot, attachrolepolicy, createpolicyversion
Provider_Name7eq 7sts.amazonaws.com, iam.amazonaws.com, ec2.amazonaws.com, kms.amazonaws.com
event.outcome7eq 7success
event.dataset4eq 4aws.cloudtrail
data_stream.dataset3eq 3aws.cloudtrail
aws::requestParameters1contains 1administratoraccess
aws::userIdentity.invokedBy1in 1autoscaling.amazonaws.com, codebuild.amazonaws.com, codepipeline.amazonaws.com
aws::userIdentity.type1eq 1awsservice

Top indicator values (29 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
event.outcomeeq
success
7375
event.dataseteq
aws.cloudtrail
417
Provider_Nameeq
sts.amazonaws.com
312
Provider_Nameeq
iam.amazonaws.com
232
Provider_Nameeq
ec2.amazonaws.com
120
Provider_Nameeq
kms.amazonaws.com
13
data_stream.dataseteq
aws.cloudtrail
3173
EventTypeeq
assumerole
13
EventTypeeq
assumeroot
1
EventTypeeq
attachrolepolicy
1
EventTypeeq
getfederationtoken
12
EventTypeeq
putkeypolicy
1
EventTypein
associateiaminstanceprofile
1
EventTypein
createpolicyversion
1
EventTypein
replaceiaminstanceprofile
1
EventTypein
setdefaultpolicyversion
1
aws::requestParameterscontains
administratoraccess
1
aws::userIdentity.invokedByin
autoscaling.amazonaws.com
1
aws::userIdentity.invokedByin
codebuild.amazonaws.com
1
aws::userIdentity.invokedByin
codepipeline.amazonaws.com
1
aws::userIdentity.invokedByin
ec2.amazonaws.com
1
aws::userIdentity.invokedByin
ecs-tasks.amazonaws.com
1
aws::userIdentity.invokedByin
ecs.amazonaws.com
1
aws::userIdentity.invokedByin
eks-fargate.amazonaws.com
1
aws::userIdentity.invokedByin
eks.amazonaws.com
1
aws::userIdentity.invokedByin
lambda.amazonaws.com
1
aws::userIdentity.invokedByin
rds.amazonaws.com
1
aws::userIdentity.invokedByin
ssm.amazonaws.com
1
aws::userIdentity.typeeq
awsservice
1

Exclusions (12 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
aws::userAgentcontains
pulumi
3
aws::userAgentcontains
terraform
3
aws::userIdentity.typeeq
awsservice
3
aws::sourceIPAddressin
cloudformation.amazonaws.com
1
aws::sourceIPAddressin
servicecatalog.amazonaws.com
1
aws::userIdentity.arnwildcard
arn*/terraform
1
aws::userIdentity.invokedByeq
ssm.amazonaws.com
1
related.entitystarts_with
arn:aws:iam::aws:policy
1
source.as.organization.nameeq
google llc
1
source.as.organization.nameeq
mongodb, inc.
1
source.as.organization.namestarts_with
AMAZON
1
source.as.organization.namestarts_with
Amazon
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: AWS

Domain: Cloud

Elastic 7 rules