Cloud Admin Role Assigned to Compromised Account

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects when an AWS IAM user policy is attached, specifically looking for the 'AttachUserPolicy' action on 'iam.amazonaws.com'. This could indicate an attempt to escalate privileges or grant new permissions to a compromised account.