AWS IAM Trust Policy Modified For Persistence
Detects modification of an AWS IAM role's trust policy to include a principal from an unknown or untrusted AWS account. This is a common persistence technique used by attackers to maintain access to a compromised environment by allowing their external account to assume the role.
YARA-L
