title: Cloud Privilege Escalation
id: af72779c-1803-5f8c-8a5f-4a9552583bec
custom_id: wf-cloud-001
status: stable
level: critical
description: |
    Detects privilege escalation events in cloud environments including
    IAM role assumption, service account key creation, and permission
    boundary modifications.
author: WitFoo
date: 2026-02-21
tags:
    - attack.privilege_escalation
    - attack.t1078.004
references:
    - https://attack.mitre.org/techniques/T1078/004/
logsource:
    product: witfoo
    service: artifact-exporter
detection:
    selection:
        messageType: "privilege_escalation"
        streamName|contains:
            - "aws"
            - "azure"
            - "gcp"
            - "cloud"
    condition: selection
fields:
    - clientIP
    - userName
    - application
    - action
    - severityLabel
    - matchedLeadRules
falsepositives:
    - Authorized IAM role changes during infrastructure provisioning
    - Cloud administrator routine operations
    - Auto-scaling service account operations