AWS IAM Access Key Creation Monitoring
Detection of unauthorized or suspicious creation of AWS IAM access keys by one user for another, a technique used for persistence and privilege escalation.
This brief addresses the detection of AWS IAM access key creation, which can be leveraged by attackers for persistence and privilege escalation. Unauthorized creation of access keys for existing IAM users allows an adversary to maintain long-term access to a cloud environment even if original credentials are revoked or rotated. This technique is frequently observed in post-exploitation scenarios, such as when tools like the Pacu framework are used to automate the backdooring of IAM users. Defenders should monitor CloudTrail logs for the CreateAccessKey API event, specifically focusing on instances where a user account creates access keys for a different identity, as this behavior often indicates malicious intent rather than standard administrative lifecycle management.
Impact
Successful exploitation results in the creation of unauthorized backdoors, allowing persistent access to the AWS environment. This significantly increases the risk of data exfiltration, resource hijacking, and lateral movement within the cloud infrastructure.
Recommendation
Deploy the provided Sigma rule to your SIEM environment to monitor CloudTrail logs for anomalous IAM access key creation. Prioritize alerts where the actor performing the CreateAccessKey action is distinct from the target user. Conduct regular audits of IAM access keys to identify over-privileged or stale credentials.
Immediate actions
Deploy Sigma detection rule to SIEM
Threat Hunt
Search historical CloudTrail logs for CreateAccessKey events where Actor ARN != Target UserName
Data: CloudTrail logs
Detection coverage 1
Detect AWS IAM Access Key Creation by Another User
mediumDetects instances where a user creates an IAM access key for a different user, which may indicate account backdooring.
Detection queries are available on the platform. Get full rules →