Detecting Cloud Privilege Escalation in AWS and Entra ID

Escalation in the cloud rarely needs an exploit. An identity with permission to attach a policy, create a new policy version, update a role’s trust policy or add itself to a privileged directory role can grant itself administrator rights through normal control-plane calls. Because the techniques are well catalogued, you can watch the short list of permission-changing calls and score them by who made them and when.

Signals at a Glance

AWS: Permission-changing Calls

The calls that change effective permissions are few. Query them, then look for administrator-equivalent policy names or wildcard actions in the request parameters:

-- Athena SQL - IAM calls that can grant administrator-equivalent access
SELECT eventtime, useridentity.arn AS actor, useridentity.type AS actor_type, sourceipaddress,
       eventname, requestparameters, errorcode
FROM cloudtrail_logs
WHERE from_iso8601_timestamp(eventtime) > current_timestamp - interval '7' day
  AND eventsource = 'iam.amazonaws.com'
  AND eventname IN ('AttachUserPolicy', 'AttachRolePolicy', 'AttachGroupPolicy', 'PutUserPolicy',
                    'PutRolePolicy', 'PutGroupPolicy', 'CreatePolicyVersion', 'SetDefaultPolicyVersion',
                    'UpdateAssumeRolePolicy', 'CreateAccessKey', 'CreateLoginProfile', 'UpdateLoginProfile')
  AND (requestparameters LIKE '%AdministratorAccess%'
       OR requestparameters LIKE '%"Action":"*"%'
       OR requestparameters LIKE '%"setAsDefault":true%'
       OR eventname IN ('CreateAccessKey', 'CreateLoginProfile', 'UpdateLoginProfile', 'UpdateAssumeRolePolicy'))
ORDER BY eventtime DESC;
-- tune/validate: allowlist your IaC and break-glass roles; CreateAccessKey for another user is the classic takeover path

• Alert when a principal modifies its own permissions or those of a principal one step above it; self-service escalation is rarely legitimate.
• Review AssumeRole chains with a role session name, source identity and source IP trail to separate automation from a human pivot.
• Use IAM Access Analyzer and permission boundaries to remove the escalation paths you can find ahead of time.

Entra ID: Privileged Role Assignment

In Entra, escalation shows up as role assignments to users or service principals. Alert on assignments to the highest-impact roles, and treat any assignment outside Privileged Identity Management as suspect:

// Microsoft Sentinel (KQL) - privileged directory role assignments
let privRoles = dynamic(["Global Administrator","Privileged Role Administrator","Privileged Authentication Administrator",
                         "Application Administrator","Cloud Application Administrator","User Administrator","Exchange Administrator"]);
AuditLogs
| where OperationName in ("Add member to role", "Add eligible member to role", "Add member to role in PIM completed (permanent)")
| where Result =~ "success"
| extend Role = tostring(TargetResources[0].modifiedProperties[1].newValue),
         Target = tostring(TargetResources[0].userPrincipalName),
         Actor = coalesce(tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName))
| where Role has_any (privRoles)
| project TimeGenerated, OperationName, Actor, Target, Role, Category
// tune/validate: the modifiedProperties index differs by operation; confirm against a sample event, then add a change-window filter

• Permanent assignment to Global Administrator outside PIM is a high-severity alert on its own.
• Application Administrator and Cloud Application Administrator can add credentials to apps that hold powerful permissions, so treat them as privileged.