Attempt To Create API Key

Status: test
Severity: medium
Log source: product aws, service cloudtrail
Author: Zach Mathis (@yamatosecurity)
Source: github.com/Yamato-Security/suzaku-rules

An attacker may have attemped to create an API key for persistence but it failed. Ex: aws appsync create-api-key --api-id ApiId I have seen this in the eventSource of appsync.amazonaws.com and apigateway.amazonaws.com. There are probably other services that can create API keys as well so I am leaving the eventSource open.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1098.001` Account Manipulation: Additional Cloud Credentials

Rules detecting the same action

These rules filter on the same operation.

API Key Created (Sigma)

Rule body

title: Attempt To Create API Key
id: 1497f3a3-7898-484e-b1e8-22fe99efd8a4
status: test
description: |
    An attacker may have attemped to create an API key for persistence but it failed.
    Ex: aws appsync create-api-key --api-id ApiId
    I have seen this in the eventSource of `appsync.amazonaws.com` and `apigateway.amazonaws.com`.
    There are probably other services that can create API keys as well so I am leaving the eventSource open.
references:
    - https://medium.com/@adan.alvarez/distorting-the-sync-how-aws-appsync-can-be-turned-into-an-attackers-backdoor-8c015b8e52b8
    - https://traildiscover.cloud/#AppSync-CreateApiKey
author: Zach Mathis (@yamatosecurity)
date: 2025-04-23
modified: 2025-05-31
tags:
    - attack.defense-evasion
    - attack.persistence
    - attack.t1098.001 #Persistence: Additional Cloud Credentials
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventName: 'CreateApiKey'
        errorCode: 'AccessDenied'
    condition: selection
falsepositives:
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    eventName: 'CreateApiKey'
    errorCode: 'AccessDenied'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`errorCode`	eq	`AccessDenied`	`field:"aws::errorCode" kind:eq value:"AccessDenied"`
`eventName`	eq	`CreateApiKey`	`field:"aws::eventName" kind:eq value:"CreateApiKey"`