Browse Rules

ZIA Additional Cloud Roles

This rule detects when an additional cloud role was created.

GCP Inbound SSO Profile Created

GCP Workforce Pool Created or Updated

GCP Workload Identity Pool Created or Updated

Slack User Privilege Escalation

Detects when a Slack user gains escalated privileges

AWS UpdateAssumeRolePolicy [splunk-awscloudtrail]

Threat actors may add additional roles to a compromised or attacker-created cloud account to achieve persistence in a cloud environment. This use case detects UpdateAssumeRolePolicy events which updates the policy that grants an IAM entity permission to assume a role. This is typically referred to as the "role trust policy".

IAM Role Added to RDS Instance or Cluster

Detects when IAM roles are added to RDS instances or clusters. While legitimate for features like S3 import/export, attackers may add overly permissive roles to maintain access or escalate privileges for data exfiltration.

AWS STS Role Chaining

Identifies role chaining activity. Role chaining is when you use one assumed role to assume a second role through the AWS CLI or API. While this a recognized functionality in AWS, role chaining can be abused for privilege escalation if the subsequent assumed role provides additional privileges. Role chaining can also be used as a persistence mechanism as each AssumeRole action results in a refreshed session token with a 1 hour maximum duration. This is a new terms rule that looks for the first o

Entra ID Global Administrator Role Assigned (PIM User)

Identifies an Azure Active Directory (AD) Global Administrator role addition to a Privileged Identity Management (PIM) user account. PIM is a service that enables you to manage, control, and monitor access to important resources in an organization. Users who are assigned to the Global administrator role can read and modify any administrative setting in your Azure AD organization.

AWS IAM AdministratorAccess Policy Attached to Role

An adversary with access to a set of compromised credentials may attempt to persist or escalate privileges by attaching additional permissions to compromised IAM roles. This rule looks for use of the IAM AttachRolePolicy API operation to attach the highly permissive AdministratorAccess AWS managed policy to an existing IAM role.

AWS EKS Access Entry Granted Cluster Admin Policy

Detects when the AmazonEKSClusterAdminPolicy or AmazonEKSAdminPolicy is associated with a principal via the EKS Access Entries API. This grants full cluster-admin equivalent access to the specified IAM user or role. Unlike the legacy aws-auth ConfigMap which is only visible in Kubernetes audit logs, Access Entries modifications appear in CloudTrail, providing an additional detection surface. Attackers who have obtained IAM permissions to manage EKS access entries can use this API to backdoor clu