• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    AWS IAM Role Trust Policy Misconfiguration (Confused Deputy)

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    tayvion payton@tayontech
    •updated Dec 10, 2025•8•2•231

    Detects AWS IAM roles whose trust policies were newly created or updated to allow cross account AWS principals to assume the role without any confused deputy protections in place.

    Splunk (SPL)

    Tags

    T1199 - Trusted RelationshipT1484.002 - Trust ModificationTA0004 - Privilege EscalationTA0001 - Initial AccessTA0005 - Defense EvasionCloud Api CallPolicy ChangeAdmin ActivityCredential AccessExploit AttemptAWSAWS Cloudtrailspl

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?