LoFP / identity and platform teams and infrastructure-as-code pipelines occasionally manage group inline policies as part of normal access governance. verify the principal in `aws.cloudtrail.user_identity.arn`, the targeted group, and the policy document against approved change records. known administration roles and deployment automation can be excluded after validation.

Techniques

• T1098

Sample rules

AWS IAM Inline Policy Added to a Group

• source: elastic
• technicques:
  • T1098

Description

Identifies an inline policy added to an IAM group via PutGroupPolicy. An inline policy attached to a group grants its permissions to every current and future member of that group. Adversaries can abuse this to escalate privileges (grant elevated permissions to a group they belong to, or will add themselves to) and to establish persistence through a durable, membership-based grant that is easy to overlook. Group inline policies are uncommon compared to managed-policy attachments, so their creation by an unexpected principal warrants review.

Detection logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "iam.amazonaws.com"
    and event.action: "PutGroupPolicy"
    and event.outcome: "success"
    and not aws.cloudtrail.user_identity.type: "AWSService"
    and not user_agent.original: (*terraform* or *pulumi* or *ansible*)
    and not aws.cloudtrail.user_identity.arn: (*terraform* or *pulumi* or *ansible*)
    and not source.as.organization.name: (Amazon* or AMAZON* or Google*)
    and not source.address: ("cloudformation.amazonaws.com" or "servicecatalog.amazonaws.com")