detecting-aws-iam-privilege-escalation

name	detecting-aws-iam-privilege-escalation
description	Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive policies, dangerous permission combinations, and least-privilege violations. Use when detecting aws iam privilege escalation paths using boto3 and cloudsplaining.
domain	cybersecurity
subdomain	cloud-security
tags	["aws","iam","privilege-escalation","cloudsplaining","boto3","policy-analysis","least-privilege"]
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]

Detecting AWS IAM Privilege Escalation

Overview

This skill uses boto3 and Cloudsplaining-style analysis to identify IAM privilege escalation paths in AWS accounts. It downloads the account authorization details, analyzes each policy for dangerous permission combinations (iam:PassRole + lambda:CreateFunction, iam:CreatePolicyVersion, sts:AssumeRole), and flags policies that violate least-privilege principles.

When to Use

Trigger phrases:

• "detecting aws iam privilege escalation"

• "Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy "

• When investigating security incidents that require detecting aws iam privilege escalation

• When building detection rules or threat hunting queries for this domain

• When SOC analysts need structured procedures for this analysis type

• When validating security monitoring coverage for related attack techniques

Prerequisites

• Python 3.8+ with boto3 library
• AWS credentials with IAM read-only access (iam:GetAccountAuthorizationDetails)
• Optional: cloudsplaining Python package for HTML report generation

Steps

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}

1. Download IAM Authorization Details — Call iam:GetAccountAuthorizationDetails to retrieve all users, groups, roles, and policies
2. Analyze Policies for Privilege Escalation — Check each policy for known escalation permission combinations
3. — Flag policies using Resource: "*" with dangerous actions