adding iam event.category

Author: imays11

rules/integrations/aws/privilege_escalation_iam_administratoraccess_policy_attached_to_group.toml

@@ -110,7 +110,7 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-any where event.dataset == "aws.cloudtrail"
+iam where event.dataset == "aws.cloudtrail"
    and event.provider == "iam.amazonaws.com"
    and event.action == "AttachGroupPolicy"
    and event.outcome == "success"

rules/integrations/aws/privilege_escalation_iam_administratoraccess_policy_attached_to_role.toml

@@ -109,7 +109,7 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-any where event.dataset == "aws.cloudtrail"
+iam where event.dataset == "aws.cloudtrail"
    and event.provider == "iam.amazonaws.com"
    and event.action == "AttachRolePolicy"
    and event.outcome == "success"

rules/integrations/aws/privilege_escalation_iam_administratoraccess_policy_attached_to_user.toml

@@ -115,7 +115,7 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-any where event.dataset == "aws.cloudtrail"
+iam where event.dataset == "aws.cloudtrail"
    and event.provider == "iam.amazonaws.com"
    and event.action == "AttachUserPolicy"
    and event.outcome == "success"