Rules: AWS CloudTrail - Permissions Boundary Lifted
A Permissions Boundary was lifted against an IAM User or Role. This unusual action may increase the effect permissions to the asset by allowing all the actions granted in its permissions policies.
| Detail | Value |
|---|---|
| Type | Templated Match |
| Category | Privilege Escalation |
| Apply Risk to Entities | device_hostname, device_ip, user_username, srcDevice_ip |
| Signal Name | AWS CloudTrail - Permissions Boundary Lifted |
| Summary Expression | {{action}} performed by user: {{user_username}} on user: {{changeTarget}} |
| Score/Severity | Static: 3 |
| Enabled by Default | True |
| Prototype | False |
| Tags | _mitreAttackTactic:TA0003, _mitreAttackTactic:TA0004, _mitreAttackTechnique:T1098, _mitreAttackTechnique:T1098.001 |
| Origin | Field |
|---|---|
| Normalized Schema | action |
| Normalized Schema | application |
| Normalized Schema | device_hostname |
| Normalized Schema | device_ip |
| Normalized Schema | metadata_product |
| Normalized Schema | metadata_vendor |
| Normalized Schema | srcDevice_ip |
| Normalized Schema | user_username |