AWS IAM Policy Modification and Immediate Attachment

tayvion payton@tayontech

•updated Feb 19, 2026•6•1•135

Detects a sequence of events where an AWS IAM Policy is modified or created and then immediately attached to a principal (user, role, or group) within a short time window (10 minutes). This behavior is highly suspicious and often indicates a rapid privilege escalation attempt or a lateral movement step where an attacker grants themselves new permissions for immediate use.