AWS IAM S3Browser LoginProfile Creation

Status: test
Severity: high
Log source: product aws, service cloudtrail
Author: daniel.bohannon@permiso.io (@danielhbohannon)
Source: github.com/SigmaHQ/sigma

Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.

Known false positives

Valid usage of S3 Browser for IAM LoginProfile listing and/or creation

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078.004` Valid Accounts: Cloud Accounts
Execution	`T1059.009` Command and Scripting Interpreter: Cloud API
Persistence	`T1078.004` Valid Accounts: Cloud Accounts
Privilege Escalation	`T1078.004` Valid Accounts: Cloud Accounts
Stealth	`T1078.004` Valid Accounts: Cloud Accounts

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `CreateLoginProfile`: Creates a password for the specified IAM user, enabling console sign-in for that user.
AWS	CloudTrail event `GetLoginProfile`: Retrieves the console login profile (password metadata) for the specified IAM user, excluding the password itself.

Rules detecting the same action

These rules filter on the same operation.

AWS IAM Credentials Added to a Bedrock API Key Phantom User (Elastic)
AWS IAM Login Profile Added for Root (Elastic)
AWS IAM Login Profile Added to User (Elastic)
AWS IAM Login Profile Created or Modified for an IAM User (Elastic)
AWS User Login Profile Created or Modified (Panther)
IAM Login Profile Created (Sigma)

Rule body

title: AWS IAM S3Browser LoginProfile Creation
id: db014773-b1d3-46bd-ba26-133337c0ffee
status: test
description: Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.
references:
    - https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor
author: daniel.bohannon@permiso.io (@danielhbohannon)
date: 2023-05-17
tags:
    - attack.execution
    - attack.persistence
    - attack.initial-access
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1059.009
    - attack.t1078.004
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'iam.amazonaws.com'
        eventName:
            - 'GetLoginProfile'
            - 'CreateLoginProfile'
        userAgent|contains: 'S3 Browser'
    condition: selection
falsepositives:
    - Valid usage of S3 Browser for IAM LoginProfile listing and/or creation
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    eventSource: 'iam.amazonaws.com'
    eventName:
        - 'GetLoginProfile'
        - 'CreateLoginProfile'
    userAgent|contains: 'S3 Browser'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`CreateLoginProfile` `GetLoginProfile`	`field:"aws::eventName" kind:eq`
`eventSource`	eq	`iam.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"iam.amazonaws.com"`
`userAgent`	match	`S3 Browser`	`field:"userAgent" kind:match value:"S3 Browser"`