ATT&CK technique
View on MITRE ATT&CK →
T1548.005
Temporary Elevated Cloud Access
Privilege Escalation
7 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | AWS EC2 Instance Profile Associated with Running Instance | production | 2026-09-18 |
| elastic | AWS IAM Customer-Managed Policy Attached to Role by Rare User | production | 2026-09-18 |
| elastic | AWS IAM Customer Managed Policy Version Created or Default Version Set | production | 2026-09-18 |
| elastic | AWS KMS Key Policy Updated via PutKeyPolicy | production | 2026-09-18 |
| elastic | AWS STS Role Assumption by Service | production | 2026-09-18 |
| elastic | AWS STS AssumeRoot by Rare User and Member Account | production | 2026-09-18 |
| elastic | AWS STS GetFederationToken with AdministratorAccess in Request | production | 2026-09-18 |