Detection Strategy for Temporary Elevated Cloud Access Abuse (T1548.005)

ID: DET0393
Domains: Enterprise
Analytics: AN1105, AN1106, AN1107
Version: 1.0
Created: 21 October 2025
Last Modified: 21 October 2025

Analytics

AN1105

Multiple AWS CloudTrail events indicating temporary privilege escalation via PassRole and AssumeRole targeting newly created services or non-interactive infrastructure.

Log Sources
Data Component Name Channel
User Account Metadata (DC0013) AWS:CloudTrail PassRole
Mutable Elements
Field Description
targetRoleName Define which roles are allowed to be assumed or passed; restrict highly privileged roles.
TimeWindow Time range between PassRole and AssumeRole events to link the privilege chain.
invokingService Restrict which services are authorized to invoke role passing (e.g., Lambda, EC2).

AN1106

Token creation or access delegation where a user impersonates a higher-privileged service account or performs domain-wide delegation actions, such as GCP's serviceAccountTokenCreator or Workspace impersonation.

Log Sources
Data Component Name Channel
User Account Metadata (DC0013) gcp:iam PrincipalEmail with serviceAccountTokenCreator impersonating new identity
User Account Authentication (DC0002) gcp:workspaceaudit Token Generation via Domain Delegation
Mutable Elements
Field Description
userEmailFilter Tune based on legitimate service accounts allowed to impersonate user accounts.
delegatedScope Limit delegated access to specific scopes relevant to business functions.

AN1107

Detection of ApplicationImpersonation role assignment or delegated mailbox access to service principals or rarely used users, especially outside of normal hours or geographic norms.

Log Sources
Data Component Name Channel
Application Log Content (DC0038) m365:unified Add-MailboxPermission or Set-ManagementRoleAssignment
User Account Authentication (DC0002) m365:signinlogs Unusual sign-in from service principal to user mailbox
Mutable Elements
Field Description
TargetMailbox Mailbox of interest where impersonation or access delegation occurs.
UserAgent Tune based on expected application or script-based mailbox access.
GeoLocation Restrict based on corporate geography or travel expectations.