Azure Add App Role Assignment To Service Principal
Grants a resource application role to a client service principal.
Privilege Escalation
Privilege Escalation
Section titled “Privilege Escalation”The adversary is trying to gain higher-level permissions.
Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities. Examples of elevated access include:
In cloud environments, privilege escalation frequently involves exploiting overly permissive IAM policies, assuming roles with broader permissions, or modifying permission boundaries. Adversaries may attach administrator policies to compromised identities, exploit trust relationships between accounts, or leverage service-linked roles to gain elevated access.
View Privilege Escalation on MITRE ATT&CK →Events Related to Privilege Escalation
Section titled “Events Related to Privilege Escalation”Explore this tactic in the map.
Azure Add Eligible Member To Role In Pim Completed
Records completed creation of PIM role eligibility.
Azure Add Member To Role
Adds a principal to a Microsoft Entra directory role.
Azure Add Owner To Application
Adds an owner to a Microsoft Entra application registration.
Azure Add Owner To Group
Adds an owner to a Microsoft Entra group.
Azure Add Role Definition (Azure RBAC)
Creates a custom Azure resource RBAC role definition.
GCP add-iam-policy-binding
Adds a role binding through a resource-specific IAM policy update.
AWS AddPermission20150331v2
Adds a statement to a Lambda resource-based policy.
AWS AddRoleToInstanceProfile
Adds one IAM role to an existing instance profile.
AWS AddUserToGroup
Adds an IAM user to a group, changing the policies that apply to the user.
AWS AssociateIamInstanceProfile
Associates an instance profile with a running or stopped EC2 instance.
AWS AssumeRole
Returns temporary security credentials for assuming an IAM role. Allows an entity (user, service, or account) to act with the role's permissions.
AWS AssumeRoleWithSAML
Exchanges a validated SAML assertion for temporary IAM role credentials.
AWS AssumeRoleWithWebIdentity
Exchanges a web-identity token for temporary IAM role credentials.
AWS AttachGroupPolicy
Attaches a managed permissions policy to an IAM group.
AWS AttachRolePolicy
Attaches a managed permissions policy to an IAM role.
AWS AttachUserPolicy
Attaches a managed permissions policy to an IAM user.
GCP compute.disks.setIamPolicy
Replaces the IAM allow policy on a Compute Engine persistent disk.
GCP compute.instances.setServiceAccount
Changes a VM’s attached service account and access scopes.
Azure Consent To Application
Records consent to an application’s requested permissions.
AWS CreateAccessEntry
Creates an EKS access entry for an existing IAM principal.
AWS CreateAccessKey
Creates a new long-term access key for an IAM user, enabling programmatic access to AWS services.
AWS CreateDevEndpoint
Creates a legacy AWS Glue development endpoint.
AWS CreateKeyPair
Creates an EC2 key pair and returns its private key to the API caller.
AWS CreateLoginProfile
Creates a console password for an IAM user.
AWS CreateOpenIDConnectProvider
Registers an OIDC identity provider in IAM.
AWS CreatePolicy
Creates a customer-managed IAM policy with an initial default version.
AWS CreatePolicyVersion
Creates a customer-managed policy version, optionally making it the operative version.
AWS CreateRole
Creates an IAM role with a trust policy and optional role settings.
AWS CreateSAMLProvider
Registers SAML identity-provider metadata in IAM.
AWS CreateServiceLinkedRole
Creates an IAM role linked to a specific AWS service.
AWS CreateVirtualMFADevice
Creates a virtual MFA device that must be enabled separately for an IAM user.
AWS DeleteRolePermissionsBoundary
Removes the permissions boundary on an IAM role, potentially changing effective access.
AWS DeleteRolePolicy
Deletes a named inline permissions policy from an IAM role.
AWS DeleteUserPermissionsBoundary
Removes the permissions boundary on an IAM user, potentially changing effective access.
AWS DeleteUserPolicy
Deletes a named inline permissions policy from an IAM user.
AWS DetachRolePolicy
Detaches a managed policy from an IAM role without deleting the policy.
AWS DetachUserPolicy
Detaches a managed policy from an IAM user without deleting the policy.
GCP EnableServiceAccount
Enables a disabled service account.
GCP generateAccessToken
Requests a short-lived OAuth access token for a service account.
AWS GetAuthorizationToken
Requests a temporary authentication token for private Amazon ECR registries.
AWS GetFederationToken
Issues temporary federated-user credentials using long-term IAM-user credentials.
AWS GetSessionToken
Issues temporary credentials for an IAM user, optionally with MFA context.
GCP google.iam.admin.v1.CreateServiceAccountKey
Creates a user-managed service-account key.
GCP google.iam.admin.v1.SetIAMPolicy
Sets the IAM allow policy on a service account.
GCP iam.roles.update
Updates a custom IAM role definition.
GCP iam.serviceAccounts.actAs
Records permission to attach a service account to a resource.
GCP iam.serviceAccounts.implicitDelegation
Identifies delegated service-account token generation.
GCP iam.serviceAccounts.signJwt
Signs a JWT using a service account’s Google-managed key.
AWS ImportKeyPair
Registers an existing public key as an EC2 key pair.
Azure Microsoft.Authorization/elevateAccess/action
Grants an Entra Global Administrator Azure User Access Administrator at root scope.
Azure Microsoft.Authorization/roleAssignments/write
Creates or updates an Azure RBAC role assignment, granting a principal specific permissions on a resource or scope.
Azure Microsoft.Directory/groups/members/update
Updates membership of an Entra group that is not role-assignable.
Azure Microsoft.Directory/servicePrincipals/credentials/update
Adds or updates credentials on an Entra service principal.
Azure Microsoft.KeyVault/vaults/accessPolicies/write
Changes access-policy entries for an Azure Key Vault.
Azure Microsoft.ManagedIdentity/userAssignedIdentities/assign/action
Authorizes attaching an existing user-assigned managed identity to a resource.
AWS PassRole
An IAM permission checked when a caller assigns a role to an AWS service; not an API event.
AWS PutGroupPolicy
Adds or replaces a named inline permissions policy on an IAM group.
AWS PutKeyPolicy
Replaces the policy on a KMS key.
AWS PutRolePermissionsBoundary
Sets or replaces the permissions boundary on an IAM role, potentially changing effective access.
AWS PutRolePolicy
Adds or replaces a named inline permissions policy on an IAM role.
AWS PutUserPermissionsBoundary
Sets or replaces the permissions boundary on an IAM user, potentially changing effective access.
AWS PutUserPolicy
Adds or replaces a named inline permissions policy on an IAM user.
AWS ReplaceIamInstanceProfileAssociation
Replaces the instance profile associated with a running EC2 instance.
AWS SetDefaultPolicyVersion
Selects an existing customer-managed IAM policy version as the operative version.
GCP storage.setIamPermissions
Records a Cloud Storage access-policy change; this example changes bucket IAM.
Azure Update Role Definition (Azure RBAC)
Updates a custom Azure resource RBAC role definition.
AWS UpdateAssumeRolePolicy
Replaces an IAM role trust policy, changing the conditions for assuming it.
AWS UpdateDevEndpoint
Changes a Glue development endpoint’s keys, arguments, or libraries.
AWS UpdateFunctionConfiguration20150331v2
Updates a Lambda function’s unpublished configuration.