AWS IAM Key Creation with Encryption Policy but without MFA

This alert focuses on identifying potentially malicious activity within Amazon Web Services (AWS) environments where Identity and Access Management (IAM) users are creating new access keys and associating them with encryption-related policies without proper multi-factor authentication (MFA). This behavior could indicate an attacker attempting to establish persistent access to the AWS environment, bypass security controls, and potentially exfiltrate or encrypt data. Although the source does not specify the exact scope or targeting, this detection aims to identify a common tactic used in cloud-based attacks to escalate privileges and maintain unauthorized access. Identifying and investigating these events promptly is crucial for maintaining the security posture of AWS environments.

Attack Chain

1. An attacker gains initial access to an AWS account, possibly through compromised credentials or other means.
2. The attacker attempts to create a new IAM user or utilizes an existing IAM user account.
3. The attacker attempts to create a new IAM access key.
4. The attacker attempts to assign an IAM policy to the user or key that grants permissions related to encryption services, such as KMS (Key Management Service).
5. The attacker performs these actions without triggering MFA.
6. The newly created key, if successful, is used to access AWS resources and services.
7. The attacker leverages the encryption permissions to encrypt data, potentially for ransomware purposes, or to gain unauthorized access to encrypted resources.
8. The attacker establishes persistence within the AWS environment, enabling long-term unauthorized access and control.

Impact

Successful exploitation could allow an attacker to gain persistent access to an AWS environment, bypass MFA controls, and escalate privileges. This can lead to unauthorized data access, exfiltration of sensitive information, or encryption of critical data for ransom. The impact ranges from data breaches and service disruption to significant financial losses. Identifying and mitigating such activities is critical for organizations relying on AWS infrastructure.