Redundant Access `T1108`

Tactics: Stealth, Persistence

**This technique has been deprecated. Please use Create Account, Web Shell, and External Remote Services where appropriate.**

Authoring guide

These 3 rules share fields, values, and exclusions.

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`aws::eventName`	3	`eq` 2, `in` 1	`UpdateLoginProfile`, `CreateAccessKey`, `CreateLoginProfile`, `DeleteLoginProfile`
`aws::eventSource`	3	`eq` 3	`iam.amazonaws.com`
`requestParameters.passwordResetRequired`	2	`is_null` 2

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`aws::eventSource`	`eq`	`iam.amazonaws.com` pantherAWS User API Key Created pantherAWS User Login Profile Created or Modified pantherDEPRECATED - AWS User Login Profile Modified	3	28
`aws::eventName`	`eq`	`CreateAccessKey` pantherAWS User API Key Created	1	3
`aws::eventName`	`eq`	`UpdateLoginProfile` pantherDEPRECATED - AWS User Login Profile Modified	1
`aws::eventName`	`in`	`CreateLoginProfile` pantherAWS User Login Profile Created or Modified	1	2
`aws::eventName`	`in`	`DeleteLoginProfile` pantherAWS User Login Profile Created or Modified	1
`aws::eventName`	`in`	`UpdateLoginProfile` pantherAWS User Login Profile Created or Modified	1

These vendors publish rules tagged with this technique.

Platform: AWS

Domain: Cloud