Detect Temporary Elevated Cloud Access in Elastic Security
Adversaries abuse cloud permission mechanisms to gain temporarily elevated access to cloud resources. This includes AWS AssumeRole, GCP impersonation, Azure PIM just-in-time access, and similar constructs. Attackers may abuse these features to escalate from a low-privilege identity to a higher-privilege role, pass roles to resources to gain persistent access, or exploit Google Workspace domain-wide delegation. The technique involves legitimate cloud APIs but used maliciously for privilege escalation beyond intended authorization.
MITRE ATT&CK
- Technique
- T1548 Abuse Elevation Control Mechanism
- Sub-technique
- T1548.005 Temporary Elevated Cloud Access
- Canonical reference
- https://attack.mitre.org/techniques/T1548/005/
Elastic Detection Query
any where (
(
event.dataset == "aws.cloudtrail" and
event.action == "AssumeRole" and
event.outcome == "success" and
(
aws.cloudtrail.request_parameters like~ "*AdministratorAccess*" or
aws.cloudtrail.request_parameters like~ "*PowerUserAccess*" or
aws.cloudtrail.request_parameters like~ "*OrganizationAccountAccessRole*" or
aws.cloudtrail.request_parameters like~ "*FullAccess*"
)
) or
(
event.dataset == "azure.auditlogs" and
event.outcome == "success" and
(
azure.auditlogs.operation_name like~ "*Add member to role in PIM completed*" or
azure.auditlogs.operation_name like~ "*Activate role*" or
azure.auditlogs.operation_name like~ "*Add eligible member to role*"
) and
(
azure.auditlogs.properties.target_resources like~ "*Owner*" or
azure.auditlogs.properties.target_resources like~ "*Global Administrator*" or
azure.auditlogs.properties.target_resources like~ "*Privileged Role Administrator*" or
azure.auditlogs.properties.target_resources like~ "*Security Administrator*" or
azure.auditlogs.properties.target_resources like~ "*Contributor*"
)
) or
(
event.dataset == "googlecloud.audit" and
(
gcp.audit.method_name like~ "*setIamPolicy*" or
gcp.audit.method_name like~ "*impersonateServiceAccount*" or
gcp.audit.method_name like~ "*signJwt*" or
gcp.audit.method_name like~ "*generateIdToken*"
)
) or
(
event.dataset == "azure.signinlogs" and
(
azure.signinlogs.properties.app_display_name like~ "*PIM*" or
azure.signinlogs.properties.app_display_name like~ "*Privileged Identity*"
) and
azure.signinlogs.properties.risk_level_during_sign_in in ("high", "medium")
)
)Detects temporary elevated cloud access abuse across AWS (AssumeRole to administrative IAM policies), Azure (PIM role activation for high-privilege roles and risky PIM sign-ins), and GCP (IAM service account impersonation and policy manipulation). Covers MITRE ATT&CK T1548.005 across all three major cloud providers using Elastic integration indices.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate IT administrators activating Azure PIM roles during approved maintenance windows with valid change management tickets — cross-reference against ServiceNow or Jira change records
- Automated CI/CD pipelines (GitHub Actions, Jenkins, Terraform Cloud) assuming high-privilege AWS roles for approved infrastructure deployments — check for known automation source IPs and IAM role naming conventions
- GCP Cloud Build jobs or Dataflow pipelines that legitimately impersonate service accounts as part of their approved execution model — validate against known build project IDs and scheduled execution times
Other platforms for T1548.005
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Check Azure PIM Role Activations (Hunting Query)
Expected signal: Sysmon EventCode 1: powershell.exe with Get-AzureADMSPrivilegedRoleAssignment command. Azure AD sign-in log for Graph API access.
- Test 2AWS AssumeRole via CLI
Expected signal: AWS CloudTrail: AssumeRole event with roleArn, requestedDuration, and caller identity. The 15-minute session duration is characteristic of testing.
- Test 3GCP Service Account Impersonation Test
Expected signal: GCP Cloud Audit Log: GenerateIdToken or impersonateServiceAccount event from the calling identity.
References (4)
- https://attack.mitre.org/techniques/T1548/005/
- https://cloud.google.com/blog/topics/threat-intelligence/exploring-critical-risk-google-workspace-domain-wide-delegation
- https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html
- https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/
Unlock Pro Content
Get the full detection package for T1548.005 including response playbook, investigation guide, and atomic red team tests.