[FEATURE] Add Sigma rule for AWS IAM privilege escalation — AdministratorAccess policy attachment detection

Is your feature request related to a problem?

OpenSearch Security Analytics currently lacks a Sigma detection rule for one of the most prevalent AWS privilege escalation techniques: attaching the AdministratorAccess managed policy to an IAM principal.

I verified this gap by searching the 156 bundled CloudTrail rules in src/main/config/rules/cloudtrail/ - there are no matches for AttachUserPolicy, AttachGroupPolicy, AttachRolePolicy, or AdministratorAccess.

An adversary who gains initial access with limited IAM mutation permissions (specifically iam:Attach*Policy) can trivially escalate to full administrative access in seconds. Without a targeted detection rule, security teams using OpenSearch have a significant blind spot for this well-documented attack path.

What solution would you like?

Add a new Sigma rule (aws_iam_administratoraccess_attached_to_principal.yml) that detects attachment of the AWS managed AdministratorAccess policy to any IAM user, group, or role via CloudTrail.

Detection logic:

• eventSource: iam.amazonaws.com
• eventName: AttachUserPolicy | AttachGroupPolicy | AttachRolePolicy
• requestParameters.policyArn: arn:aws:iam::aws:policy/AdministratorAccess

MITRE ATT&CK mapping:

• Tactic: Privilege Escalation, Persistence
• Technique: T1098.003 (Account Manipulation: Additional Cloud Roles)
  Severity: High

Deliverables:

• Rule file placed in src/main/config/rules/cloudtrail/
• Unit test (AwsIamAdministratorAccessAttachedRuleTests.java) with a sample AttachUserPolicy CloudTrail event that triggers the rule

What alternatives have you considered?

• Elastic Security ships a prebuilt rule ("AWS IAM AdministratorAccess Policy Attached to User"), but Elastic's detection corpus is separate from OpenSearch/Sigma and not available to OpenSearch Security Analytics users.
• SigmaHQ: Confirmed no equivalent rule exists in the SigmaHQ AWS CloudTrail rule set as of today.
• Custom detector rules: Users can manually write this rule themselves, but shipping it as a bundled rule means all OpenSearch Security Analytics users get coverage out of the box with zero configuration.

Do you have any additional context?

Attack example::
aws iam attach-user-policy
--user-name target-user
--policy-arn arn:aws:iam::aws:policy/AdministratorAccess

Why this is high-value:

• One of the most common AWS privilege escalation methods documented by Rhino Security Labs and HackingThe.Cloud
• Low false-positive potential: attaching AdministratorAccess is rare in well-governed environments
• Broader than user-only: covers group and role attachment for complete coverage
• Clean MITRE ATT&CK mapping to T1098.003

References:
https://attack.mitre.org/techniques/T1098/003/
https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachUserPolicy.html
https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/
https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/

I am happy to submit a PR implementing this rule with an accompanying unit test. Open to feedback on scope or approach.

Start by reviewing the existing rules in src/main/config/rules/cloudtrail/ and the surrounding rule tests to follow their Sigma and CloudTrail conventions. Add aws_iam_administratoraccess_attached_to_principal.yml and implement AwsIamAdministratorAccessAttachedRuleTests.java with the supplied AttachUserPolicy event. Done means the event triggers the rule and the requested user, group, and role policy attachments are covered.