IAM Access Key Created

Status: test
Severity: medium
Log source: product aws, service cloudtrail
Author: nishikawaakira (@nishikawaakira)
Source: github.com/Yamato-Security/suzaku-rules

Detects when an IAM access key is created via CreateAccessKey. Attackers create access keys for persistence after compromising an account, often targeting an existing user or a newly created backdoor user. Note: This is different from CreateApiKey (AppSync/API Gateway).

Known false positives

Legitimate key rotation by administrators or automation

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1098.001` Account Manipulation: Additional Cloud Credentials

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `CreateAccessKey`: Creates a new AWS access key pair (access key ID and secret access key) for the specified IAM user.

Rules detecting the same action

These rules filter on the same operation.

AWS IAM Backdoor Users Keys (Sigma)
AWS IAM Credentials Added to a Bedrock API Key Phantom User (Elastic)
AWS IAM S3Browser User or AccessKey Creation (Sigma)
AWS IAM Sensitive Operations via Lambda Execution Role (Elastic)
AWS IAM User Created Access Keys For Another User (Elastic)
AWS IAM User Self-Created Access Key Subsequently Used (Elastic)
AWS Sensitive IAM Operations Performed via CloudShell (Elastic)
AWS User API Key Created (Panther)

Rule body

title: IAM Access Key Created
id: 2c4d6e8f-0a1b-3c5d-7e9f-1a2b3c4d5e6f
status: test
description: |
    Detects when an IAM access key is created via CreateAccessKey.
    Attackers create access keys for persistence after compromising an account,
    often targeting an existing user or a newly created backdoor user.
    Note: This is different from CreateApiKey (AppSync/API Gateway).
references:
    - https://attack.mitre.org/techniques/T1098/001/
    - https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateAccessKey.html
author: nishikawaakira (@nishikawaakira)
date: 2026-05-03
modified: 2026-05-29
tags:
    - attack.persistence
    - attack.t1098.001
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: iam.amazonaws.com
        eventName: CreateAccessKey
    filter:
        errorCode|exists: true
    condition: selection and not filter
falsepositives:
    - Legitimate key rotation by administrators or automation
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
    eventSource: iam.amazonaws.com
    eventName: CreateAccessKey

Stage 2: `not filter`

filter:
    errorCode|exists: true

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`errorCode`	is_not_null	(no value, null check)	`excludes:errorCode`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`CreateAccessKey`	`field:"aws::eventName" kind:eq value:"CreateAccessKey"`
`eventSource`	eq	`iam.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"iam.amazonaws.com"`