IAM User Created

Status: test
Severity: high
Log source: product aws, service cloudtrail
Author: nishikawaakira (@nishikawaakira)
Source: github.com/Yamato-Security/suzaku-rules

Detects when an IAM user creates a new IAM user via CreateUser. This is a common persistence technique where an attacker with compromised credentials creates a backdoor IAM user for continued access even after the originally compromised credentials are rotated.

Known false positives

Legitimate IAM administrators creating new users
Automated provisioning systems (Terraform, CloudFormation, SCIM)

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1136.003` Create Account: Cloud Account

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `CreateUser`: Creates a new IAM user in the AWS account with a specified user name.

Rules detecting the same action

These rules filter on the same operation.

AWS IAM Create User via Assumed Role on EC2 Instance (Elastic)
AWS IAM S3Browser User or AccessKey Creation (Sigma)
AWS IAM Sensitive Operations via Lambda Execution Role (Elastic)
AWS Sensitive IAM Operations Performed via CloudShell (Elastic)
High-Risk Cross-Cloud User Impersonation (Kusto)
IAM User Creation Attempt (Sigma)

Rule body

title: IAM User Created
id: 8f3a7b2c-1d4e-5f6a-9b0c-2e3d4f5a6b7c
status: test
description: |
    Detects when an IAM user creates a new IAM user via CreateUser.
    This is a common persistence technique where an attacker with compromised
    credentials creates a backdoor IAM user for continued access even after
    the originally compromised credentials are rotated.
references:
    - https://attack.mitre.org/techniques/T1136/003/
    - https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateUser.html
    - https://hackingthe.cloud/aws/post_exploitation/create_a_console_session_from_iam_credentials/
author: nishikawaakira (@nishikawaakira)
date: 2026-05-03
modified: 2026-05-29
tags:
    - attack.persistence
    - attack.t1136.003
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: iam.amazonaws.com
        eventName: CreateUser
    filter:
        errorCode|exists: true
    condition: selection and not filter
falsepositives:
    - Legitimate IAM administrators creating new users
    - Automated provisioning systems (Terraform, CloudFormation, SCIM)
level: high

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
    eventSource: iam.amazonaws.com
    eventName: CreateUser

Stage 2: `not filter`

filter:
    errorCode|exists: true

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`errorCode`	is_not_null	(no value, null check)	`excludes:errorCode`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`CreateUser`	`field:"aws::eventName" kind:eq value:"CreateUser"`
`eventSource`	eq	`iam.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"iam.amazonaws.com"`