aws:cloudtrail AttachRolePolicy
AttachRolePolicy
- Log source
- AWS CloudTrail
- Host type
- AWS
- Tier, host type
- Recommended
- Techniques
- 0
- Rules depending on it
- Elastic 7, Microsoft Sentinel 3
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| AWS account | Recommended |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
Elastic 7
- AWS IAM AdministratorAccess Policy Attached to Role
- AWS IAM Customer-Managed Policy Attached to Role by Rare User
- AWS IAM Sensitive Operations via Lambda Execution Role
- AWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity
- AWS Rare Source AS Organization Activity
- AWS SES Full Access Policy Attached to IAM Entity by Unusual User
- AWS Sensitive IAM Operations Performed via CloudShell