New detections for AWS IAM privilege escalation

[privet-username]

Summary of the Pull Request

This pull request addes three new AWS CloudTrail detection rules focused on IAM Privilege Escalation techniques:

1. AWS IAM Critical Managed Policy Attachment: Detects the attachment of highly privileged AWS-managed policies (AdministratorAccess, PowerUserAccess, IAMFullAccess) to IAM users, roles, or groups.
2. AWS IAM Privileged Inline Policy Creation or Modification: Tracks both the initial creation and the subsequent updates (Put*Policy upserts) of inline policies that plant wildcard "*" administrative rights directly into identities.
3. AWS IAM Customer Managed Policy Version Created or Default Version Set: A consolidated rule that detects stealthy version-based privilege escalation. It triggers when a new privileged version is created as default, or when an identity rolls back to an older, potentially highly privileged policy version.

Changelog

new: AWS IAM Critical Managed Policy Attachment
new: AWS IAM Privileged Inline Policy Creation
new: AWS IAM Customer Managed Policy Version Created or Default Version Set

Example Log Event

N/A

Fixed Issues

None.

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[swachchhanda000]

Hi @privet-username,

Thanks for the submission. Right now, these detections still need supporting evidence/examples before we can review them with confidence.

We want to avoid merging rules that are based mainly on plausible descriptions or assumed event fields which are mostly AI generated without showing how they map to actual CloudTrail logs without any testing/validation in the test environment or derived from some research blog posts.

Please add supporting material such as:

raw or sanitized example logs
production testing/validation stats/screenshots
blog posts or references
Exact AWS docs supporting the exact fields used

I’m not closing this PR for now, but we’d need that context before moving forward.

Please treat this as a general expectation for future submissions too: fewer well-supported rules are preferable to more rules that are hard to verify.
We are doing these bcz there are too many AI slops PRs these days

Thanks.