Skip to content
Threat Feed
medium advisory

AWS IAM Access Key Creation Monitoring

Detection of unauthorized or suspicious creation of AWS IAM access keys by one user for another, a technique used for persistence and privilege escalation.

This brief addresses the detection of AWS IAM access key creation, which can be leveraged by attackers for persistence and privilege escalation. Unauthorized creation of access keys for existing IAM users allows an adversary to maintain long-term access to a cloud environment even if original credentials are revoked or rotated. This technique is frequently observed in post-exploitation scenarios, such as when tools like the Pacu framework are used to automate the backdooring of IAM users. Defenders should monitor CloudTrail logs for the CreateAccessKey API event, specifically focusing on instances where a user account creates access keys for a different identity, as this behavior often indicates malicious intent rather than standard administrative lifecycle management.

Impact

Successful exploitation results in the creation of unauthorized backdoors, allowing persistent access to the AWS environment. This significantly increases the risk of data exfiltration, resource hijacking, and lateral movement within the cloud infrastructure.

Recommendation

Deploy the provided Sigma rule to your SIEM environment to monitor CloudTrail logs for anomalous IAM access key creation. Prioritize alerts where the actor performing the CreateAccessKey action is distinct from the target user. Conduct regular audits of IAM access keys to identify over-privileged or stale credentials.


Immediate actions

Deploy Sigma detection rule to SIEM

Detection Engineering 72h

Threat Hunt

Search historical CloudTrail logs for CreateAccessKey events where Actor ARN != Target UserName

T1098 medium high confidence hunt now

Data: CloudTrail logs

Detection coverage 1

Detect AWS IAM Access Key Creation by Another User

medium

Detects instances where a user creates an IAM access key for a different user, which may indicate account backdooring.

sigma tactics: persistence, privilege-escalation techniques: T1098 sources: cloudtrail, aws

Detection queries are available on the platform. Get full rules →