AWS Identity and Access Management (IAM)

Elastic #

• AWS CloudTrail Log Evasion source medium: Identifies the evasion of cloudtrail logging for IAM actions involving policy creation, modification or attachment. When making certain policy-related API calls, an adversary may pad the associated policy document with whitespaces to trigger CloudTrail’s logging size constraints, resulting in incomplete logging where critical details about the policy are omitted. By exploiting this gap, threat actors can bypass monitoring performed through CloudTrail and can effectively obscure unauthorized changes. This rule looks for IAM API calls with the requestParameters property containing reason:”requestParameters too large” and omitted:true.T1562, T1562.008
• AWS IAM API Calls via Temporary Session Tokens source high: Detects sensitive AWS IAM API operations executed using temporary session credentials (access key IDs beginning with "ASIA"). Temporary credentials are commonly issued through sts:GetSessionToken, sts:AssumeRole, or AWS SSO logins and are meant for short-term use. It is unusual for legitimate users or automated processes to perform privileged IAM actions (e.g., creating users, updating policies, or enabling/disabling MFA) with session tokens. This behavior may indicate credential theft, session hijacking, or the abuse of a privileged role’s temporary credentials.T1078, T1078.004, T1098
• AWS EC2 Instance Interaction with IAM Service source low: Identifies when an EC2 instance interacts with the AWS IAM service via an assumed role. This is uncommon behavior and could indicate an attacker using compromised credentials to further exploit an environment. For example, an assumed role could be used to create new users for persistence or add permissions for privilege escalation. An EC2 instance assumes a role using their EC2 ID as the session name. This rule looks for the pattern "i-" which is the beginning pattern for assumed role sessions started by an EC2 instance. This is a building block rule and does not generate alerts on its own. It is meant to be used for correlation with other rules to detect suspicious activity.T1078, T1078.004, T1098, T1098.001, T1098.003

Elastic #

• AWS Sensitive IAM Operations Performed via CloudShell source high: Identifies sensitive AWS IAM operations performed via AWS CloudShell based on the user agent string. CloudShell is a browser-based shell that provides command-line access to AWS resources directly from the AWS Management Console. While convenient for administrators, CloudShell access from compromised console sessions can enable attackers to perform privileged operations without installing tools or using programmatic credentials. This rule detects high-risk actions such as creating IAM users, access keys, roles, or attaching policies when initiated from CloudShell, which may indicate post-compromise credential harvesting or privilege escalation activity.T1098, T1098.001, T1098.003, T1136, T1136.003↳ also matches AttachRolePolicy, AttachUserPolicy, CreateAccessKey, CreateInstanceProfile, CreateRole, CreateUser, PutRolePolicy, PutUserPolicy
• AWS IAM Sensitive Operations via Lambda Execution Role source high: Detects successful IAM API calls that create or empower IAM users and roles, attach or embed policies, or wire roles to instance profiles when the caller is an assumed role session associated with AWS Lambda. Serverless execution roles are often over-permissioned; an adversary who can run or compromise function code can abuse these APIs for privilege escalation and persistence—for example creating users or roles, issuing keys, attaching managed or inline policies, or preparing EC2 instance profiles for lateral movement.T1078, T1078.004, T1098, T1136, T1136.003↳ also matches AddUserToGroup, AttachGroupPolicy, AttachRolePolicy, AttachUserPolicy, CreateAccessKey, CreateInstanceProfile, and 4 more

Elastic #

• AWS IAM User Addition to Group source low: Identifies the addition of a user to a specified group in AWS Identity and Access Management (IAM). Any user added to a group automatically gains the permissions that are assigned to the group. If the target group carries elevated or admin privileges, this action can instantly grant high-risk permissions useful for credential misuse, lateral movement, or privilege escalation.T1098, T1098.003
• AWS IAM Sensitive Operations via Lambda Execution Role source high: Detects successful IAM API calls that create or empower IAM users and roles, attach or embed policies, or wire roles to instance profiles when the caller is an assumed role session associated with AWS Lambda. Serverless execution roles are often over-permissioned; an adversary who can run or compromise function code can abuse these APIs for privilege escalation and persistence—for example creating users or roles, issuing keys, attaching managed or inline policies, or preparing EC2 instance profiles for lateral movement.T1078, T1078.004, T1098, T1136, T1136.003↳ also matches AddRoleToInstanceProfile, AttachGroupPolicy, AttachRolePolicy, AttachUserPolicy, CreateAccessKey, CreateInstanceProfile, and 4 more

Kusto #

• High-Risk Cross-Cloud User Impersonation source medium: This detection focuses on identifying high-risk cross-cloud activities and sign-in anomalies that may indicate potential security threats. The query starts by analyzing Microsoft Entra ID Signin Logs to pinpoint instances where specific applications, risk levels, and result types align. It then correlates this information with relevant AWS CloudTrail events to identify activities across Azure and AWS environments.T1078, T1078.002, T1078.004, T1134↳ also matches CreateAccessKey, CreateGroup, CreateRole, CreateUser, CreateVirtualMFADevice, DeleteGroup, and 10 more

Sigma #

• IAM Policy Attachment Attempt source medium: Detects a failed attempt to attach an IAM policy to a user, group, or role. Even though the attempt was denied, it indicates the attacker has valid credentials and is attempting privilege escalation. This is commonly observed when attackers use stolen credentials that lack IAM write permissions. Note: AccessDenied events may have empty requestParameters, so this rule does not filter by policy name to avoid missing detections.T1098, T1098.003↳ also matches AttachRolePolicy, AttachUserPolicy
• IAM Admin Policy Attached source critical: Detects when an administrative IAM policy (AdministratorAccess, PowerUserAccess, or IAMFullAccess) is attached to a user, group, or role. This is a privilege escalation technique where an attacker elevates permissions of a compromised or newly created principal to gain full control of the AWS account.T1098, T1098.003↳ also matches AttachRolePolicy, AttachUserPolicy

Elastic #

• AWS IAM AdministratorAccess Policy Attached to Group source medium: An adversary with access to a set of compromised credentials may attempt to persist or escalate privileges by attaching additional permissions to user groups the compromised user account belongs to. This rule looks for use of the IAM AttachGroupPolicy API operation to attach the highly permissive AdministratorAccess AWS managed policy to an existing IAM user group.T1098, T1098.003
• AWS IAM Sensitive Operations via Lambda Execution Role source high: Detects successful IAM API calls that create or empower IAM users and roles, attach or embed policies, or wire roles to instance profiles when the caller is an assumed role session associated with AWS Lambda. Serverless execution roles are often over-permissioned; an adversary who can run or compromise function code can abuse these APIs for privilege escalation and persistence—for example creating users or roles, issuing keys, attaching managed or inline policies, or preparing EC2 instance profiles for lateral movement.T1078, T1078.004, T1098, T1136, T1136.003↳ also matches AddRoleToInstanceProfile, AddUserToGroup, AttachRolePolicy, AttachUserPolicy, CreateAccessKey, CreateInstanceProfile, and 4 more

Kusto #

• AWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation source medium: Identifies creation of IAM policies that provide broad CRUD permissions for DynamoDB, followed by policy attachment activity. This sequence can indicate an attempt to grant capabilities that support privilege escalation and should be validated against approved administrative changes.T1098, T1098.003, T1484↳ also matches AttachRolePolicy, AttachUserPolicy
• AWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation source medium: Identifies creation of IAM policies that grant broad IAM CRUD permissions, followed by attachment of that policy to a user, role, or group. This pattern may indicate an attempt to establish or expand privileged access and should be reviewed as potential privilege escalation.T1098, T1098.003, T1484↳ also matches AttachRolePolicy, AttachUserPolicy
• AWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation source medium: Identifies creation of IAM policies that grant permissions for broad KMS CRUD actions, followed by attachment activity to a principal. This sequence can be used to expand access to encryption keys or disable protections and should be investigated as possible privilege escalation.T1098, T1098.003, T1484↳ also matches AttachRolePolicy, AttachUserPolicy

Show 12 more (15 total) on the rules page

YARA-L #

• AWS IAM Activity From EC2 Instance source high: Detect AWS IAM activities made by AWS EC2 instances to retain access or escalate privileges.T1098↳ also matches AttachRolePolicy, AttachUserPolicy, CreateAccessKey, CreateLoginProfile, CreateRole, UpdateLoginProfile
• AWS IAM Administrator Access Policy Attached source high: Detects when AWS IAM AdministratorAccess policy is attached to a user, group or role which can be used for privilege escalation.T1078↳ also matches AttachRolePolicy, AttachUserPolicy
• AWS IAM Compromised Key Quarantine Policy Attached source high: Detect when the AWS managed policy AWSCompromisedKeyQuarantine has been attached to a user, role, or group. It is applied by the AWS team in the event that the credentials of an IAM user has been compromised or publicly exposed.T1552↳ also matches AttachRolePolicy, AttachUserPolicy

Panther #

• AWS Compromised IAM Key Quarantine source high: Detects when an IAM user has the AWSCompromisedKeyQuarantineV2 policy attached to their account.T1078.004, T1552.001↳ also matches AttachRolePolicy, AttachUserPolicy
• IAM Policy Modified source informational: An IAM Policy was changed.T1548↳ also matches AttachRolePolicy, AttachUserPolicy, PutRolePolicy, PutUserPolicy, DeleteGroupPolicy, DeleteRolePolicy, and 5 more

Sigma #

• IAM Policy Attachment Attempt source medium: Detects a failed attempt to attach an IAM policy to a user, group, or role. Even though the attempt was denied, it indicates the attacker has valid credentials and is attempting privilege escalation. This is commonly observed when attackers use stolen credentials that lack IAM write permissions. Note: AccessDenied events may have empty requestParameters, so this rule does not filter by policy name to avoid missing detections.T1098, T1098.003↳ also matches AttachGroupPolicy, AttachUserPolicy
• IAM Admin Policy Attached source critical: Detects when an administrative IAM policy (AdministratorAccess, PowerUserAccess, or IAMFullAccess) is attached to a user, group, or role. This is a privilege escalation technique where an attacker elevates permissions of a compromised or newly created principal to gain full control of the AWS account.T1098, T1098.003↳ also matches AttachGroupPolicy, AttachUserPolicy

Elastic #

• AWS IAM AdministratorAccess Policy Attached to Role source medium: An adversary with access to a set of compromised credentials may attempt to persist or escalate privileges by attaching additional permissions to compromised IAM roles. This rule looks for use of the IAM AttachRolePolicy API operation to attach the highly permissive AdministratorAccess AWS managed policy to an existing IAM role.T1098, T1098.003
• AWS IAM Customer-Managed Policy Attached to Role by Rare User source low: Detects when an AWS Identity and Access Management (IAM) customer-managed policy is attached to a role by an unusual or unauthorized user. Customer-managed policies are policies created and controlled within an AWS account, granting specific permissions to roles or users when attached. This rule identifies potential privilege escalation by flagging cases where a customer-managed policy is attached to a role by an unexpected actor, which could signal unauthorized access or misuse. Attackers may attach policies to roles to expand permissions and elevate their privileges within the AWS environment. This is a New Terms rule that uses the "cloud.account.id", "user.name" and "entity.target.id" fields to check if the combination of the actor identity and target role name has not been seen before.T1098, T1548, T1548.005
• AWS Sensitive IAM Operations Performed via CloudShell source high: Identifies sensitive AWS IAM operations performed via AWS CloudShell based on the user agent string. CloudShell is a browser-based shell that provides command-line access to AWS resources directly from the AWS Management Console. While convenient for administrators, CloudShell access from compromised console sessions can enable attackers to perform privileged operations without installing tools or using programmatic credentials. This rule detects high-risk actions such as creating IAM users, access keys, roles, or attaching policies when initiated from CloudShell, which may indicate post-compromise credential harvesting or privilege escalation activity.T1098, T1098.001, T1098.003, T1136, T1136.003↳ also matches AddRoleToInstanceProfile, AttachUserPolicy, CreateAccessKey, CreateInstanceProfile, CreateRole, CreateUser, PutRolePolicy, PutUserPolicy

Show 1 more (4 total) on the rules page

Kusto #

• AWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation source medium: Identifies creation of IAM policies that provide broad CRUD permissions for DynamoDB, followed by policy attachment activity. This sequence can indicate an attempt to grant capabilities that support privilege escalation and should be validated against approved administrative changes.T1098, T1098.003, T1484↳ also matches AttachGroupPolicy, AttachUserPolicy
• AWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation source medium: Identifies creation of IAM policies that grant broad IAM CRUD permissions, followed by attachment of that policy to a user, role, or group. This pattern may indicate an attempt to establish or expand privileged access and should be reviewed as potential privilege escalation.T1098, T1098.003, T1484↳ also matches AttachGroupPolicy, AttachUserPolicy
• AWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation source medium: Identifies creation of IAM policies that grant permissions for broad KMS CRUD actions, followed by attachment activity to a principal. This sequence can be used to expand access to encryption keys or disable protections and should be investigated as possible privilege escalation.T1098, T1098.003, T1484↳ also matches AttachGroupPolicy, AttachUserPolicy

Show 12 more (15 total) on the rules page

YARA-L #

• AWS IAM Activity From EC2 Instance source high: Detect AWS IAM activities made by AWS EC2 instances to retain access or escalate privileges.T1098↳ also matches AttachGroupPolicy, AttachUserPolicy, CreateAccessKey, CreateLoginProfile, CreateRole, UpdateLoginProfile
• AWS IAM Administrator Access Policy Attached source high: Detects when AWS IAM AdministratorAccess policy is attached to a user, group or role which can be used for privilege escalation.T1078↳ also matches AttachGroupPolicy, AttachUserPolicy
• AWS IAM Compromised Key Quarantine Policy Attached source high: Detect when the AWS managed policy AWSCompromisedKeyQuarantine has been attached to a user, role, or group. It is applied by the AWS team in the event that the credentials of an IAM user has been compromised or publicly exposed.T1552↳ also matches AttachGroupPolicy, AttachUserPolicy

Panther #

• AWS Compromised IAM Key Quarantine source high: Detects when an IAM user has the AWSCompromisedKeyQuarantineV2 policy attached to their account.T1078.004, T1552.001↳ also matches AttachGroupPolicy, AttachUserPolicy
• IAM Policy Modified source informational: An IAM Policy was changed.T1548↳ also matches AttachGroupPolicy, AttachUserPolicy, PutRolePolicy, PutUserPolicy, DeleteGroupPolicy, DeleteRolePolicy, and 5 more

Sigma #

• IAM Policy Attachment Attempt source medium: Detects a failed attempt to attach an IAM policy to a user, group, or role. Even though the attempt was denied, it indicates the attacker has valid credentials and is attempting privilege escalation. This is commonly observed when attackers use stolen credentials that lack IAM write permissions. Note: AccessDenied events may have empty requestParameters, so this rule does not filter by policy name to avoid missing detections.T1098, T1098.003↳ also matches AttachGroupPolicy, AttachRolePolicy
• IAM Admin Policy Attached source critical: Detects when an administrative IAM policy (AdministratorAccess, PowerUserAccess, or IAMFullAccess) is attached to a user, group, or role. This is a privilege escalation technique where an attacker elevates permissions of a compromised or newly created principal to gain full control of the AWS account.T1098, T1098.003↳ also matches AttachGroupPolicy, AttachRolePolicy

Elastic #

• AWS IAM CompromisedKeyQuarantine Policy Attached to User source high: This rule looks for use of the IAM AttachUserPolicy API operation to attach the CompromisedKeyQuarantine or CompromisedKeyQuarantineV2 AWS managed policies to an existing IAM user. This policy denies access to certain actions and is applied by the AWS team in the event that an IAM user's credentials have been compromised or exposed publicly.T1078, T1078.004, T1552
• AWS IAM AdministratorAccess Policy Attached to User source high: An adversary with access to a set of compromised credentials may attempt to persist or escalate privileges by attaching additional permissions to compromised user accounts. This rule looks for use of the IAM AttachUserPolicy API operation to attach the highly permissive AdministratorAccess AWS managed policy to an existing IAM user.T1098, T1098.003
• AWS Sensitive IAM Operations Performed via CloudShell source high: Identifies sensitive AWS IAM operations performed via AWS CloudShell based on the user agent string. CloudShell is a browser-based shell that provides command-line access to AWS resources directly from the AWS Management Console. While convenient for administrators, CloudShell access from compromised console sessions can enable attackers to perform privileged operations without installing tools or using programmatic credentials. This rule detects high-risk actions such as creating IAM users, access keys, roles, or attaching policies when initiated from CloudShell, which may indicate post-compromise credential harvesting or privilege escalation activity.T1098, T1098.001, T1098.003, T1136, T1136.003↳ also matches AddRoleToInstanceProfile, AttachRolePolicy, CreateAccessKey, CreateInstanceProfile, CreateRole, CreateUser, PutRolePolicy, PutUserPolicy

Show 1 more (4 total) on the rules page

Kusto #

• AWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation source medium: Identifies creation of IAM policies that provide broad CRUD permissions for DynamoDB, followed by policy attachment activity. This sequence can indicate an attempt to grant capabilities that support privilege escalation and should be validated against approved administrative changes.T1098, T1098.003, T1484↳ also matches AttachGroupPolicy, AttachRolePolicy
• AWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation source medium: Identifies creation of IAM policies that grant broad IAM CRUD permissions, followed by attachment of that policy to a user, role, or group. This pattern may indicate an attempt to establish or expand privileged access and should be reviewed as potential privilege escalation.T1098, T1098.003, T1484↳ also matches AttachGroupPolicy, AttachRolePolicy
• AWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation source medium: Identifies creation of IAM policies that grant permissions for broad KMS CRUD actions, followed by attachment activity to a principal. This sequence can be used to expand access to encryption keys or disable protections and should be investigated as possible privilege escalation.T1098, T1098.003, T1484↳ also matches AttachGroupPolicy, AttachRolePolicy

Show 12 more (15 total) on the rules page

YARA-L #

• AWS IAM Activity From EC2 Instance source high: Detect AWS IAM activities made by AWS EC2 instances to retain access or escalate privileges.T1098↳ also matches AttachGroupPolicy, AttachRolePolicy, CreateAccessKey, CreateLoginProfile, CreateRole, UpdateLoginProfile
• AWS IAM Administrator Access Policy Attached source high: Detects when AWS IAM AdministratorAccess policy is attached to a user, group or role which can be used for privilege escalation.T1078↳ also matches AttachGroupPolicy, AttachRolePolicy
• AWS IAM Compromised Key Quarantine Policy Attached source high: Detect when the AWS managed policy AWSCompromisedKeyQuarantine has been attached to a user, role, or group. It is applied by the AWS team in the event that the credentials of an IAM user has been compromised or publicly exposed.T1552↳ also matches AttachGroupPolicy, AttachRolePolicy

Panther #

• AWS Compromised IAM Key Quarantine source high: Detects when an IAM user has the AWSCompromisedKeyQuarantineV2 policy attached to their account.T1078.004, T1552.001↳ also matches AttachGroupPolicy, AttachRolePolicy
• IAM Policy Modified source informational: An IAM Policy was changed.T1548↳ also matches AttachGroupPolicy, AttachRolePolicy, PutRolePolicy, PutUserPolicy, DeleteGroupPolicy, DeleteRolePolicy, and 5 more

Sigma #

• AWS IAM Backdoor Users Keys source medium: Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS environment. Also with this alert, you can detect a flow of AWS keys in your org.T1098
• AWS IAM S3Browser User or AccessKey Creation source high: Detects S3 Browser utility creating IAM User or AccessKey.T1059, T1059.009, T1078, T1078.004↳ also matches CreateUser
• IAM Access Key Creation Attempt source medium: Detects a failed attempt to create an IAM access key (AccessDenied). Even though the attempt failed, it indicates the attacker has valid credentials and is attempting persistence via access key creation.T1098, T1098.001

Show 1 more (4 total) on the rules page

Elastic #

• AWS IAM User Created Access Keys For Another User source high: An adversary with access to a set of compromised credentials may attempt to persist or escalate privileges by creating a new set of credentials for an existing user. This rule looks for use of the IAM CreateAccessKey API operation to create new programmatic access keys for another IAM user.T1098, T1098.001
• AWS IAM User Self-Created Access Key Subsequently Used source medium: Detects an AWS IAM user using an existing credential to create a new access key for itself and subsequently using the new key within one hour. This behavior can indicate an adversary converting compromised credentials into an additional long-term credential for persistence. Unlike a standalone self-service key creation alert, requiring subsequent use of the new key reduces noise from unused or abandoned credential-rotation operations.T1098, T1098.001
• AWS IAM Credentials Added to a Bedrock API Key Phantom User source high: Identifies standard IAM credentials being added to an Amazon Bedrock API key phantom user, whose user name starts with "BedrockAPIKey-": either a long-term access key (CreateAccessKey) or a console password / login profile (CreateLoginProfile, UpdateLoginProfile). When a long-term Bedrock API key is generated through the AWS Console, AWS silently provisions a "BedrockAPIKey-<id>" IAM user with the AmazonBedrockLimitedAccess managed policy. That user is intended only to back a Bedrock bearer token and should never hold standard programmatic keys or interactive console access. Adding either converts a Bedrock-scoped identity into general-purpose IAM credentials that inherit the policy's Bedrock control-plane and IAM, VPC, and KMS reconnaissance permissions and that persist after the Bedrock API key is revoked. This is the privilege-escalation and persistence pivot documented for Bedrock API key phantom users, and there is no legitimate workflow that produces it.T1098, T1098.001↳ also matches CreateLoginProfile, UpdateLoginProfile

Show 2 more (5 total) on the rules page

Splunk #

• ASL AWS Create Access Key source: The following analytic identifies the creation of AWS IAM access keys by a user for another user, which can indicate privilege escalation. It leverages AWS CloudTrail logs to detect instances where the user creating the access key is…T1136, T1136.003
• AWS CreateAccessKey source: The following analytic identifies the creation of AWS IAM access keys by a user for another user, which can indicate privilege escalation. It leverages AWS CloudTrail logs to detect instances where the user creating the access key is…T1136, T1136.003

Kusto #

• AWSCloudTrail - Creation of Access Key for IAM User source medium: Detects creation of a new IAM access key on an existing user account, which could be used to establish persistence. This action should be validated by the AWS account administrator. Reference: https://stratus-red-team.cloud/attack-techniques/AWS/aws.persistence.iam-backdoor-user/T1098, T1098.001
• High-Risk Cross-Cloud User Impersonation source medium: This detection focuses on identifying high-risk cross-cloud activities and sign-in anomalies that may indicate potential security threats. The query starts by analyzing Microsoft Entra ID Signin Logs to pinpoint instances where specific applications, risk levels, and result types align. It then correlates this information with relevant AWS CloudTrail events to identify activities across Azure and AWS environments.T1078, T1078.002, T1078.004, T1134↳ also matches AddUserToGroup, CreateGroup, CreateRole, CreateUser, CreateVirtualMFADevice, DeleteGroup, and 10 more

YARA-L #

• AWS IAM Activity By S3 Browser Utility source high: Detect AWS IAM activities associated with the S3 Browser utility.T1098↳ also matches CreateLoginProfile, PutUserPolicy
• AWS Privilege Escalation Using IAM Access Key source low: Detect when a user creates a new access key for another user and escalates privileges using this newly created access key from the same IP.T1136
• AWS User Creates Permanent Access Key source medium: Detects when an AWS IAM user creates an AWS Access Key for programmatic calls.T1078

Show 1 more (4 total) on the rules page

Panther #

• AWS User API Key Created source medium: Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS environment.T1098, T1108, T1550
• Root Account Access Key Created source critical: Detects creation of programmatic access keys for the AWS root account, which violates critical security best practices. Root account credentials provide unrestricted access to all AWS resources and cannot be scoped with granular permissions. If compromised, these keys grant attackers complete control over the AWS environment including billing and account closure capabilities.T1098
• New IAM Credentials Updated source informational: A console password, access key, or user has been created.T1098↳ also matches CreateLoginProfile

Elastic #

• AWS IAM Group Creation source low: Identifies the creation of a group in AWS Identity and Access Management (IAM). Groups specify permissions for multiple users. Any user in a group automatically has the permissions that are assigned to the group. Adversaries who obtain credentials with IAM write privileges may create a new group as a foothold for persistence: they can later attach admin-level policies to the group and quietly add users or roles to inherit those privileges.T1136, T1136.003

Kusto #

• High-Risk Cross-Cloud User Impersonation source medium: This detection focuses on identifying high-risk cross-cloud activities and sign-in anomalies that may indicate potential security threats. The query starts by analyzing Microsoft Entra ID Signin Logs to pinpoint instances where specific applications, risk levels, and result types align. It then correlates this information with relevant AWS CloudTrail events to identify activities across Azure and AWS environments.T1078, T1078.002, T1078.004, T1134↳ also matches AddUserToGroup, CreateAccessKey, CreateRole, CreateUser, CreateVirtualMFADevice, DeleteGroup, and 10 more

Elastic #

• AWS Sensitive IAM Operations Performed via CloudShell source high: Identifies sensitive AWS IAM operations performed via AWS CloudShell based on the user agent string. CloudShell is a browser-based shell that provides command-line access to AWS resources directly from the AWS Management Console. While convenient for administrators, CloudShell access from compromised console sessions can enable attackers to perform privileged operations without installing tools or using programmatic credentials. This rule detects high-risk actions such as creating IAM users, access keys, roles, or attaching policies when initiated from CloudShell, which may indicate post-compromise credential harvesting or privilege escalation activity.T1098, T1098.001, T1098.003, T1136, T1136.003↳ also matches AddRoleToInstanceProfile, AttachRolePolicy, AttachUserPolicy, CreateAccessKey, CreateRole, CreateUser, PutRolePolicy, PutUserPolicy
• AWS IAM Sensitive Operations via Lambda Execution Role source high: Detects successful IAM API calls that create or empower IAM users and roles, attach or embed policies, or wire roles to instance profiles when the caller is an assumed role session associated with AWS Lambda. Serverless execution roles are often over-permissioned; an adversary who can run or compromise function code can abuse these APIs for privilege escalation and persistence—for example creating users or roles, issuing keys, attaching managed or inline policies, or preparing EC2 instance profiles for lateral movement.T1078, T1078.004, T1098, T1136, T1136.003↳ also matches AddRoleToInstanceProfile, AddUserToGroup, AttachGroupPolicy, AttachRolePolicy, AttachUserPolicy, CreateAccessKey, and 4 more

Sigma #

• AWS IAM S3Browser LoginProfile Creation source high: Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.T1059, T1059.009, T1078, T1078.004↳ also matches GetLoginProfile
• IAM Login Profile Created source medium: Establishes persistence by creating a Login Profile on an existing IAM user. This allows an attacker to access an IAM user intended to be used programmatically through the AWS console usual login process. This can also be detected with UpdateLoginProfile events. If an account is meant to be used only programmatically, it should not have a login profile.T1098, T1098.001

Elastic #

• AWS IAM Login Profile Added for Root source high: Identifies creation of a console login profile for the AWS account root user. While CreateLoginProfile normally applies to IAM users, when performed from a temporary root session (e.g., via AssumeRoot) and the userName parameter is omitted, the profile is created for the root principal (self-assigned). Adversaries with temporary root access may add or reset the root login profile to establish persistent console access even if original access keys are rotated or disabled. Correlate with recent AssumeRoot/STS activity and validate intent with the account owner.T1078, T1078.004, T1098, T1098.001
• AWS IAM Login Profile Created or Modified for an IAM User source medium: Identifies creation or modification of a console login profile for an AWS IAM user via CreateLoginProfile or UpdateLoginProfile. A login profile enables password-based console sign-in for an IAM user. Adversaries who obtain programmatic credentials may create a login profile to add persistent interactive console access, or update an existing profile to reset another user's password and take over the account, even after the original access keys are rotated. Because console access for IAM users is increasingly provisioned through federation or IAM Identity Center, direct use of these APIs by an unexpected principal warrants review. This rule targets IAM users (the userName parameter is present); creation of a login profile for the account root user is covered by a separate rule.T1098, T1098.001↳ also matches UpdateLoginProfile
• AWS IAM Login Profile Added to User source low: Identifies when an AWS IAM login profile is added to a user. Adversaries may add a login profile to an IAM user who typically does not have one and is used only for programmatic access. This can be used to maintain access to the account even if the original access key is rotated or disabled. This is a building block rule and does not generate alerts on its own. It is meant to be used for correlation with other rules to detect suspicious activity.T1078, T1078.004, T1098, T1098.001, T1098.003

Show 1 more (4 total) on the rules page

Splunk #

• AWS CreateLoginProfile source: The following analytic identifies the creation of a login profile for one AWS user by another, followed by a console login from the same source IP. It uses AWS CloudTrail logs to correlate the CreateLoginProfile and ConsoleLogin events…T1136, T1136.003

YARA-L #

• AWS Privilege Escalation Using IAM Login Profile source low: Detect when a user creates or updates a login profile for another user and escalates privileges using this new user from the same IP.T1136↳ also matches UpdateLoginProfile
• AWS IAM Activity By S3 Browser Utility source high: Detect AWS IAM activities associated with the S3 Browser utility.T1098↳ also matches CreateAccessKey, PutUserPolicy
• AWS IAM Activity From EC2 Instance source high: Detect AWS IAM activities made by AWS EC2 instances to retain access or escalate privileges.T1098↳ also matches AttachGroupPolicy, AttachRolePolicy, AttachUserPolicy, CreateAccessKey, CreateRole, UpdateLoginProfile

Panther #

• AWS User Login Profile Created or Modified source low: An attacker with iam:UpdateLoginProfile permission on other users can change the password used to login to the AWS console. May be legitimate account administration.T1098, T1108, T1550↳ also matches DeleteLoginProfile, UpdateLoginProfile
• New IAM Credentials Updated source informational: A console password, access key, or user has been created.T1098↳ also matches CreateAccessKey

Elastic #

• AWS IAM OIDC Provider Created by Rare User source high: Detects when an uncommon user or role creates an OpenID Connect (OIDC) Identity Provider in AWS IAM. OIDC providers enable web identity federation, allowing users authenticated by external identity providers (such as Google, GitHub, or custom OIDC-compliant providers) to assume IAM roles and access AWS resources. Adversaries who have gained administrative access may create rogue OIDC providers to establish persistent, federated access that survives credential rotation. This technique allows attackers to assume roles using tokens from an IdP they control. While OIDC provider creation is benign in some environments, it should still be validated against authorized infrastructure changes.T1078, T1078.004, T1484, T1484.002

Elastic #

• AWS IAM Customer Managed Policy Version Created or Default Version Set source medium: Identifies successful IAM API calls that create a new customer managed policy version or set the default version for an existing customer managed policy. Attackers with iam:CreatePolicyVersion or iam:SetDefaultPolicyVersion on a privileged policy can introduce a permissive policy document and activate it, escalating effective permissions without attaching a new policy. These APIs are high impact when the target policy is attached to powerful roles or users.T1098, T1548, T1548.005↳ also matches SetDefaultPolicyVersion

Splunk #

• AWS Create Policy Version to allow all resources source: The following analytic identifies the creation of a new AWS IAM policy version that allows access to all resources. It detects this activity by analyzing AWS CloudTrail logs for the CreatePolicyVersion event with a policy document that…T1078, T1078.004

Elastic #

• AWS Sensitive IAM Operations Performed via CloudShell source high: Identifies sensitive AWS IAM operations performed via AWS CloudShell based on the user agent string. CloudShell is a browser-based shell that provides command-line access to AWS resources directly from the AWS Management Console. While convenient for administrators, CloudShell access from compromised console sessions can enable attackers to perform privileged operations without installing tools or using programmatic credentials. This rule detects high-risk actions such as creating IAM users, access keys, roles, or attaching policies when initiated from CloudShell, which may indicate post-compromise credential harvesting or privilege escalation activity.T1098, T1098.001, T1098.003, T1136, T1136.003↳ also matches AddRoleToInstanceProfile, AttachRolePolicy, AttachUserPolicy, CreateAccessKey, CreateInstanceProfile, CreateUser, PutRolePolicy, PutUserPolicy
• AWS IAM Sensitive Operations via Lambda Execution Role source high: Detects successful IAM API calls that create or empower IAM users and roles, attach or embed policies, or wire roles to instance profiles when the caller is an assumed role session associated with AWS Lambda. Serverless execution roles are often over-permissioned; an adversary who can run or compromise function code can abuse these APIs for privilege escalation and persistence—for example creating users or roles, issuing keys, attaching managed or inline policies, or preparing EC2 instance profiles for lateral movement.T1078, T1078.004, T1098, T1136, T1136.003↳ also matches AddRoleToInstanceProfile, AddUserToGroup, AttachGroupPolicy, AttachRolePolicy, AttachUserPolicy, CreateAccessKey, and 4 more

Kusto #

• High-Risk Cross-Cloud User Impersonation source medium: This detection focuses on identifying high-risk cross-cloud activities and sign-in anomalies that may indicate potential security threats. The query starts by analyzing Microsoft Entra ID Signin Logs to pinpoint instances where specific applications, risk levels, and result types align. It then correlates this information with relevant AWS CloudTrail events to identify activities across Azure and AWS environments.T1078, T1078.002, T1078.004, T1134↳ also matches AddUserToGroup, CreateAccessKey, CreateGroup, CreateUser, CreateVirtualMFADevice, DeleteGroup, and 10 more

YARA-L #

• AWS IAM Activity From EC2 Instance source high: Detect AWS IAM activities made by AWS EC2 instances to retain access or escalate privileges.T1098↳ also matches AttachGroupPolicy, AttachRolePolicy, AttachUserPolicy, CreateAccessKey, CreateLoginProfile, UpdateLoginProfile

Panther #

• IAM Role Created source informational: An IAM role was created.T1078
• IAM Entity Created Without CloudFormation source medium: An IAM Entity (Group, Policy, Role, or User) was created manually. IAM entities should be created in code to ensure that permissions are tracked and managed correctly.T1136↳ also matches CreateServiceLinkedRole

Elastic #

• AWS IAM SAML Provider Created source high: Detects the creation of a new SAML Identity Provider (IdP) in AWS IAM. SAML providers enable federated authentication between AWS and external identity providers, allowing users to access AWS resources using credentials from the external IdP. Adversaries who have gained administrative access may create rogue SAML providers to establish persistent, federated access to AWS accounts that survives credential rotation. This technique allows attackers to assume roles and access resources by forging SAML assertions from an IdP they control. Creating a SAML provider is a rare administrative action that should be closely monitored and validated against authorized infrastructure changes.T1078, T1078.004, T1098, T1098.001, T1484, T1484.002

YARA-L #

• AWS SAML Identity Provider Changes source medium: Detects create, update or delete events of a SAML provider in AWS.T1078↳ also matches DeleteSAMLProvider, UpdateSAMLProvider

Panther #

• AWS SAML Activity source medium: Identifies when SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.↳ also matches DeleteSAMLProvider, UpdateSAMLProvider

Sigma #

• IAM User Creation Attempt source medium: Detects a failed attempt to create an IAM user (AccessDenied). Even though the attempt failed, it indicates the attacker has valid credentials and is attempting persistence via IAM user creation.T1136, T1136.003
• IAM User Created source high: Detects when an IAM user creates a new IAM user via CreateUser. This is a common persistence technique where an attacker with compromised credentials creates a backdoor IAM user for continued access even after the originally compromised credentials are rotated.T1136, T1136.003
• AWS IAM S3Browser User or AccessKey Creation source high: Detects S3 Browser utility creating IAM User or AccessKey.T1059, T1059.009, T1078, T1078.004↳ also matches CreateAccessKey

Elastic #

• AWS IAM Create User via Assumed Role on EC2 Instance source high: Detects the creation of an AWS Identity and Access Management (IAM) user initiated by an assumed role on an EC2 instance. Assumed roles allow users or services to temporarily adopt different AWS permissions, but the creation of IAM users through these roles, particularly from within EC2 instances, may indicate a compromised instance. Adversaries might exploit such permissions to establish persistence by creating new IAM users under unauthorized conditions.T1136, T1136.003
• AWS Sensitive IAM Operations Performed via CloudShell source high: Identifies sensitive AWS IAM operations performed via AWS CloudShell based on the user agent string. CloudShell is a browser-based shell that provides command-line access to AWS resources directly from the AWS Management Console. While convenient for administrators, CloudShell access from compromised console sessions can enable attackers to perform privileged operations without installing tools or using programmatic credentials. This rule detects high-risk actions such as creating IAM users, access keys, roles, or attaching policies when initiated from CloudShell, which may indicate post-compromise credential harvesting or privilege escalation activity.T1098, T1098.001, T1098.003, T1136, T1136.003↳ also matches AddRoleToInstanceProfile, AttachRolePolicy, AttachUserPolicy, CreateAccessKey, CreateInstanceProfile, CreateRole, PutRolePolicy, PutUserPolicy
• AWS IAM Sensitive Operations via Lambda Execution Role source high: Detects successful IAM API calls that create or empower IAM users and roles, attach or embed policies, or wire roles to instance profiles when the caller is an assumed role session associated with AWS Lambda. Serverless execution roles are often over-permissioned; an adversary who can run or compromise function code can abuse these APIs for privilege escalation and persistence—for example creating users or roles, issuing keys, attaching managed or inline policies, or preparing EC2 instance profiles for lateral movement.T1078, T1078.004, T1098, T1136, T1136.003↳ also matches AddRoleToInstanceProfile, AddUserToGroup, AttachGroupPolicy, AttachRolePolicy, AttachUserPolicy, CreateAccessKey, and 4 more

Kusto #

• High-Risk Cross-Cloud User Impersonation source medium: This detection focuses on identifying high-risk cross-cloud activities and sign-in anomalies that may indicate potential security threats. The query starts by analyzing Microsoft Entra ID Signin Logs to pinpoint instances where specific applications, risk levels, and result types align. It then correlates this information with relevant AWS CloudTrail events to identify activities across Azure and AWS environments.T1078, T1078.002, T1078.004, T1134↳ also matches AddUserToGroup, CreateAccessKey, CreateGroup, CreateRole, CreateVirtualMFADevice, DeleteGroup, and 10 more

Elastic #

• AWS IAM Virtual MFA Device Registration Attempt with Session Token source high: Detects attempts to create or enable a Virtual MFA device (CreateVirtualMFADevice, EnableMFADevice) using temporary AWS credentials (access keys beginning with ASIA). Session credentials are short-lived and tied to existing authenticated sessions, so using them to register or enable MFA devices is unusual. Adversaries who compromise temporary credentials may abuse this behavior to establish persistence by attaching new MFA devices to maintain access to high-privilege accounts despite key rotation or password resets.T1078, T1078.004, T1098, T1098.005, T1556, T1556.006↳ also matches EnableMFADevice

Splunk #

• ASL AWS New MFA Method Registered For User source: The following analytic identifies the registration of a new Multi-Factor Authentication (MFA) method for an AWS account, as logged through Amazon Security Lake (ASL). It detects this activity by monitoring the CreateVirtualMFADevice API…T1556, T1556.006
• AWS New MFA Method Registered For User source: The following analytic detects the registration of a new Multi-Factor Authentication (MFA) method for an AWS account. It leverages AWS CloudTrail logs to identify the CreateVirtualMFADevice event. This activity is significant because…T1556, T1556.006

Kusto #

• High-Risk Cross-Cloud User Impersonation source medium: This detection focuses on identifying high-risk cross-cloud activities and sign-in anomalies that may indicate potential security threats. The query starts by analyzing Microsoft Entra ID Signin Logs to pinpoint instances where specific applications, risk levels, and result types align. It then correlates this information with relevant AWS CloudTrail events to identify activities across Azure and AWS environments.T1078, T1078.002, T1078.004, T1134↳ also matches AddUserToGroup, CreateAccessKey, CreateGroup, CreateRole, CreateUser, DeleteGroup, and 10 more

YARA-L #

• AWS New MFA Method Registered For User source medium: Detects the registration of a new Multi Factor authentication method for an AWS user.T1556↳ also matches EnableMFADevice

Elastic #

• AWS IAM Deactivation of MFA Device source high: Detects the deactivation of a Multi-Factor Authentication (MFA) device in AWS Identity and Access Management (IAM). MFA provides critical protection against unauthorized access by requiring a second factor for authentication. Adversaries or compromised administrators may deactivate MFA devices to weaken account protections, disable strong authentication, or prepare for privilege escalation or persistence. This rule monitors successful DeactivateMFADevice API calls, which represent the point at which MFA protection is actually removed.T1531, T1556, T1556.006

Splunk #

• ASL AWS Multi-Factor Authentication Disabled source: The following analytic detects attempts to disable multi-factor authentication (MFA) for an AWS IAM user. It leverages Amazon Security Lake logs, specifically monitoring for DeleteVirtualMFADevice or DeactivateMFADevice API operations.…T1556, T1556.006, T1586, T1586.003, T1621↳ also matches DeleteVirtualMFADevice
• AWS Multi-Factor Authentication Disabled source: The following analytic detects attempts to disable multi-factor authentication (MFA) for an AWS IAM user. It leverages AWS CloudTrail logs to identify events where MFA devices are deleted or deactivated. This activity is significant…T1556, T1556.006, T1586, T1586.003, T1621↳ also matches DeleteVirtualMFADevice

Kusto #

• Multi-Factor Authentication Disabled for a User source medium: Multi-Factor Authentication (MFA) helps prevent credential compromise. This alert identifies when an attempt has been made to deactivate MFA for a user.T1098, T1556↳ also matches DeleteVirtualMFADevice

YARA-L #

• AWS MultiFactor Authentication Disabled source medium: Detects attempts to disable multi-factor authentication for an AWS IAM user.T1556↳ also matches DeleteVirtualMFADevice

Elastic #

• AWS IAM Account Password Policy Deleted source medium: Identifies deletion of the AWS account password policy via DeleteAccountPasswordPolicy. The account password policy enforces minimum password requirements (length, complexity, rotation, and reuse) for all IAM users in the account. Deleting it removes those requirements account-wide, weakening authentication and easing follow-on credential-based attacks. This is an account-level change that legitimately occurs only during deliberate administration, so its deletion by an unexpected principal warrants review.T1556

Splunk #

• AWS Password Policy Changes source: The following analytic detects successful API calls to view, update, or delete the password policy in an AWS organization. It leverages AWS CloudTrail logs to identify events such as "UpdateAccountPasswordPolicy,"…T1201↳ also matches UpdateAccountPasswordPolicy, GetAccountPasswordPolicy

YARA-L #

• AWS Password Policy Change source medium: Detects when an existing password policy is updated or deleted in an AWS account.T1201↳ also matches UpdateAccountPasswordPolicy

Elastic #

• AWS IAM Group Deletion source low: Detects when an IAM group is deleted using the DeleteGroup API call. Deletion of an IAM group may represent a malicious attempt to remove audit trails, disrupt operations, or hide adversary activity (for example after using the group briefly for privileged access). This can be an indicator of impact or cleanup in an attack lifecycle.T1531

Splunk #

• AWS IAM Failure Group Deletion source: The following analytic identifies failed attempts to delete AWS IAM groups. It leverages AWS CloudTrail logs to detect events where the DeleteGroup action fails due to errors like NoSuchEntityException, DeleteConflictException, or…T1098
• AWS IAM Successful Group Deletion source: The following analytic identifies the successful deletion of an IAM group in AWS. It leverages CloudTrail logs to detect DeleteGroup events with a success status. This activity is significant as it could indicate potential changes in…T1069, T1069.003, T1098

Kusto #

• High-Risk Cross-Cloud User Impersonation source medium: This detection focuses on identifying high-risk cross-cloud activities and sign-in anomalies that may indicate potential security threats. The query starts by analyzing Microsoft Entra ID Signin Logs to pinpoint instances where specific applications, risk levels, and result types align. It then correlates this information with relevant AWS CloudTrail events to identify activities across Azure and AWS environments.T1078, T1078.002, T1078.004, T1134↳ also matches AddUserToGroup, CreateAccessKey, CreateGroup, CreateRole, CreateUser, CreateVirtualMFADevice, and 10 more

Sigma #

• IAM Login Profile Deleted source low: Detects when an IAM login profile is deleted, which may indicate an attacker removing access to a compromised account or an administrator performing account cleanup.T1531

Kusto #

• High-Risk Cross-Cloud User Impersonation source medium: This detection focuses on identifying high-risk cross-cloud activities and sign-in anomalies that may indicate potential security threats. The query starts by analyzing Microsoft Entra ID Signin Logs to pinpoint instances where specific applications, risk levels, and result types align. It then correlates this information with relevant AWS CloudTrail events to identify activities across Azure and AWS environments.T1078, T1078.002, T1078.004, T1134↳ also matches AddUserToGroup, CreateAccessKey, CreateGroup, CreateRole, CreateUser, CreateVirtualMFADevice, and 10 more

Panther #

• AWS User Login Profile Created or Modified source low: An attacker with iam:UpdateLoginProfile permission on other users can change the password used to login to the AWS console. May be legitimate account administration.T1098, T1108, T1550↳ also matches CreateLoginProfile, UpdateLoginProfile

Sigma #

• AWS SAML Provider Deletion Activity source medium: Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access. An attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.T1078, T1078.004, T1531

YARA-L #

• AWS SAML Identity Provider Changes source medium: Detects create, update or delete events of a SAML provider in AWS.T1078↳ also matches CreateSAMLProvider, UpdateSAMLProvider

Panther #

• AWS SAML Activity source medium: Identifies when SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.↳ also matches CreateSAMLProvider, UpdateSAMLProvider

Splunk #

• ASL AWS Multi-Factor Authentication Disabled source: The following analytic detects attempts to disable multi-factor authentication (MFA) for an AWS IAM user. It leverages Amazon Security Lake logs, specifically monitoring for DeleteVirtualMFADevice or DeactivateMFADevice API operations.…T1556, T1556.006, T1586, T1586.003, T1621↳ also matches DeactivateMFADevice
• AWS Multi-Factor Authentication Disabled source: The following analytic detects attempts to disable multi-factor authentication (MFA) for an AWS IAM user. It leverages AWS CloudTrail logs to identify events where MFA devices are deleted or deactivated. This activity is significant…T1556, T1556.006, T1586, T1586.003, T1621↳ also matches DeactivateMFADevice

Kusto #

• Multi-Factor Authentication Disabled for a User source medium: Multi-Factor Authentication (MFA) helps prevent credential compromise. This alert identifies when an attempt has been made to deactivate MFA for a user.T1098, T1556↳ also matches DeactivateMFADevice

YARA-L #

• AWS MultiFactor Authentication Disabled source medium: Detects attempts to disable multi-factor authentication for an AWS IAM user.T1556↳ also matches DeactivateMFADevice