Product
AWS IAM Privilege Operations via Lambda Execution Role
2 rules 3 TTPsDetection of IAM API calls that create or empower IAM users and roles, attach policies, or configure instance profiles when the caller is an assumed role session associated with AWS Lambda, potentially indicating privilege escalation or persistence.
AWS Credentials Used from GitHub Actions and Non-CI/CD Infrastructure
2 rules 2 TTPsAttackers are stealing AWS credentials configured as GitHub Actions secrets and using them from non-CI/CD infrastructure, indicating potential credential theft and unauthorized access to AWS resources.
S3Browser IAM Policy Creation with Default Bucket Name
2 rules 3 TTPsAn AWS IAM policy is created by the S3Browser utility with the default S3 bucket name placeholder, potentially indicating unauthorized access or misconfiguration.
Suspicious AWS SAML Activity Detection
2 rules 3 TTPsThis rule identifies suspicious SAML activity in AWS, such as AssumeRoleWithSAML and UpdateSAMLProvider events, which could indicate an attacker gaining backdoor access, escalating privileges, or establishing persistence.
AWS IAM User or Access Key Creation via S3 Browser
2 rules 2 TTPsThe use of S3 Browser to create IAM users or access keys in AWS environments indicates a potential privilege escalation, persistence, or initial access attempt by threat actors leveraging a known cloud administration tool.
S3 Browser Used to Create IAM Login Profiles
2 rules 2 TTPsThe S3 Browser utility is being used to enumerate IAM users lacking login profiles and subsequently create them, potentially for reconnaissance, persistence, and privilege escalation within AWS environments.