T1548.005 — Temporary Elevated Cloud Access

Tactic: Privilege Escalation · Platforms: IaaS, Office Suite, Identity Provider

Adversaries may abuse permission configurations that allow them to gain temporarily elevated access to cloud resources. Many cloud environments allow administrators to grant user or service accounts permission to request just-in-time access to roles, impersonate other accounts, pass roles onto…

Sub-technique of Abuse Elevation Control Mechanism (T1548).

Sigma detection rules (3)

T1548.005 Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access

title: "T1548.005 Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access"
id: ac426975-82bb-4439-b0ec-72a23aa3cf3d
description: 'Detection Strategy for Temporary Elevated Cloud Access Abuse (T1548.005). (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: targetRoleName, TimeWindow, invokingService.'
references:
  - https://attack.mitre.org/techniques/T1548/005
author: Shahrukh Khan
date: 2026-03-08
license: MIT
tags:
  - attack.privilege-escalation
  - attack.t1548.005

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource: 'sts.amazonaws.com'
    eventName: 'AssumeRole'
    requestParameters.durationSeconds|gte: 43200

  condition: selection

falsepositives:
  - Long-running batch or ETL jobs that legitimately request extended session durations to avoid credential expiry mid-job.

level: medium

T1548.005 Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access

title: "T1548.005 Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access"
id: 1092ba74-ef9a-4c00-93e3-31b75570a64c
description: 'Detection Strategy for Temporary Elevated Cloud Access Abuse (T1548.005). (Data Component: User Account Metadata; baseline tier: fallback.) Tune using: userEmailFilter, delegatedScope.'
references:
  - https://attack.mitre.org/techniques/T1548/005
author: Shahrukh Khan
date: 2026-01-11
license: MIT
tags:
  - attack.privilege-escalation
  - attack.t1548.005

logsource:
  product: gcp
  service: iam

detection:
  selection:
    protoPayload.methodName: 'SetIamPolicy'
  selection_condition:
    protoPayload.request.policy.bindings.condition.expression|contains: 'request.time'

  condition: selection and selection_condition

falsepositives:
  - Scheduled just-in-time access grants issued through an approved privileged access management workflow.

level: high

T1548.005 Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access

title: "T1548.005 Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access"
id: edb2b6bf-6f1c-45eb-bdaa-708b736c83c3
description: 'Detection Strategy for Temporary Elevated Cloud Access Abuse (T1548.005). (Data Component: Application Log Content; baseline tier: fallback.) Tune using: TargetMailbox, UserAgent, GeoLocation.'
references:
  - https://attack.mitre.org/techniques/T1548/005
author: Shahrukh Khan
date: 2026-03-31
license: MIT
tags:
  - attack.privilege-escalation
  - attack.t1548.005

logsource:
  product: m365
  service: unified

detection:
  selection:
    Operation:
      - 'Add-MailboxPermission'
      - 'Add-RecipientPermission'
    Parameters.Name: 'AccessRights'
    Parameters.Value|contains: 'FullAccess'

  condition: selection

falsepositives:
  - Help desk staff granting delegate mailbox access as part of an approved shared-mailbox provisioning request.

level: high

Related sub-techniques

Explore