aws:cloudtrail AttachUserPolicy
AttachUserPolicy
- Log source
- AWS CloudTrail
- Host type
- AWS
- Tier, host type
- Minimum
- Techniques
- 3
- Rules depending on it
- Elastic 6, Microsoft Sentinel 3
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| AWS account | Minimum |
Techniques it helps detect
Rules that depend on it
Elastic 6
- AWS IAM AdministratorAccess Policy Attached to User
- AWS IAM CompromisedKeyQuarantine Policy Attached to User
- AWS IAM Sensitive Operations via Lambda Execution Role
- AWS Rare Source AS Organization Activity
- AWS SES Full Access Policy Attached to IAM Entity by Unusual User
- AWS Sensitive IAM Operations Performed via CloudShell