AWS CreateLoginProfile Activity Detection

This brief focuses on detecting the creation of AWS IAM login profiles. While the source material provides limited context, the action itself—creating a login profile—can be a signal of interest. Attackers may create new IAM users or modify existing ones (creating login profiles if they don't exist) to establish persistence, escalate privileges, or move laterally within an AWS environment. Defenders should monitor these activities closely, especially if they deviate from established baselines or involve suspicious actors. The aws_createloginprofile.yml file suggests a detection rule exists within Splunk's security content framework to identify this behavior. Monitoring for this event can help identify potentially malicious activity in AWS environments.

Attack Chain

1. Initial Compromise: (Assumed) The attacker gains initial access to an AWS account, possibly through compromised credentials or an exposed API key (Not documented in source).
2. Privilege Escalation: The attacker attempts to escalate their privileges within the AWS environment, either through exploiting misconfigurations or leveraging existing IAM roles (Not documented in source).
3. IAM Manipulation: The attacker interacts with the AWS IAM service, specifically targeting user management (Observed - CreateLoginProfile).
4. Create Login Profile: The attacker uses the CreateLoginProfile API call to create a login profile for a new or existing IAM user. This provides the user with console access, enabling interactive login.
5. Persistence: The attacker leverages the newly created user with console access as a means of persistence within the AWS environment.
6. Lateral Movement: The attacker uses the new or modified user to access other AWS resources or services, expanding their control within the environment.
7. Data Exfiltration / Damage: (Assumed) The attacker utilizes their access to exfiltrate sensitive data or cause damage to the AWS infrastructure. (Not documented in source).

Impact

The successful creation of a login profile by a malicious actor can lead to unauthorized access to AWS resources, data breaches, and service disruption. Attackers may use these profiles to maintain persistence, escalate privileges, and move laterally within the AWS environment. The number of victims depends on the scope of the attacker's access and the sensitivity of the compromised resources.

Recommendation

• Deploy the Sigma rule for AWS CreateLoginProfile Activity to your SIEM and tune for your environment (Reference: aws_createloginprofile.yml).
• Investigate any instances of CreateLoginProfile events, especially those performed by unfamiliar IAM entities, to validate legitimacy.
• Monitor AWS CloudTrail logs for CreateLoginProfile events to ensure comprehensive visibility into IAM activity.
• Enforce multi-factor authentication (MFA) for all IAM users to reduce the risk of credential compromise (General Security Best Practice).