AWS IAM Backdoor Users Keys

Status: test
Severity: medium
Log source: product aws, service cloudtrail
Author: faloker
Source: github.com/SigmaHQ/sigma

Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS environment. Also with this alert, you can detect a flow of AWS keys in your org.

Known false positives

Adding user keys to their own accounts (the filter cannot cover all possible variants of user naming)
AWS API keys legitimate exchange workflows

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1098` Account Manipulation
Privilege Escalation	`T1098` Account Manipulation

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `CreateAccessKey`: Creates a new AWS access key pair (access key ID and secret access key) for the specified IAM user.

Rules detecting the same action

These rules filter on the same operation.

AWS IAM Credentials Added to a Bedrock API Key Phantom User (Elastic)
AWS IAM S3Browser User or AccessKey Creation (Sigma)
AWS IAM Sensitive Operations via Lambda Execution Role (Elastic)
AWS IAM User Created Access Keys For Another User (Elastic)
AWS IAM User Self-Created Access Key Subsequently Used (Elastic)
AWS Sensitive IAM Operations Performed via CloudShell (Elastic)
AWS User API Key Created (Panther)
High-Risk Cross-Cloud User Impersonation (Kusto)

Rule body

title: AWS IAM Backdoor Users Keys
id: 0a5177f4-6ca9-44c2-aacf-d3f3d8b6e4d2
status: test
description: |
  Detects AWS API key creation for a user by another user.
  Backdoored users can be used to obtain persistence in the AWS environment.
  Also with this alert, you can detect a flow of AWS keys in your org.
references:
    - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/iam__backdoor_users_keys/main.py
author: faloker
date: 2020-02-12
modified: 2022-10-09
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1098
logsource:
    product: aws
    service: cloudtrail
detection:
    selection_source:
        eventSource: iam.amazonaws.com
        eventName: CreateAccessKey
    filter:
        userIdentity.arn|contains: responseElements.accessKey.userName
    condition: selection_source and not filter
falsepositives:
    - Adding user keys to their own accounts (the filter cannot cover all possible variants of user naming)
    - AWS API keys legitimate exchange workflows
level: medium

Stages and Predicates

Stage 0: `condition`

selection_source and not filter

Stage 1: `selection_source`

selection_source:
    eventSource: iam.amazonaws.com
    eventName: CreateAccessKey

Stage 2: `not filter`

filter:
    userIdentity.arn|contains: responseElements.accessKey.userName

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`userIdentity.arn`	match	`responseElements.accessKey.userName`	`excludes:userIdentity.arn` `field:"userIdentity.arn" value:"responseElements.accessKey.userName"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`CreateAccessKey`	`field:"aws::eventName" kind:eq value:"CreateAccessKey"`
`eventSource`	eq	`iam.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"iam.amazonaws.com"`