AWS IAM Role Trust Policy or Managed Policy Modification Followed by Role Assumption
Detects a sequence of events where an AWS IAM Role Trust Policy or a Role's managed policy is modified (UpdateAssumeRolePolicy, PutRolePolicy) and is immediately followed by a successful assumption of that role (AssumeRole, AssumeRoleWithSAML, etc.) within a 10-minute window. This behavior is characteristic of an attacker setting up a backdoor or escalating privileges by granting a new, unauthorized principal (user, service, or account) permission to assume a critical role.
Splunk (SPL)
