Attack Chain

1. An attacker gains unauthorized access to an AWS account, potentially through credential theft or other means.
2. The attacker attempts to create a new IAM user or assume an existing IAM role to gain greater control over AWS resources.
3. The attacker creates a new access key associated with either the compromised user or newly created/assumed role.
4. The attacker attaches an encryption policy to the created access key, granting it the ability to encrypt data at rest or in transit.
5. The creation of the access key and attachment of the encryption policy occurs without requiring MFA, indicating a bypass of security best practices.
6. The attacker uses the newly created access key to encrypt sensitive data stored in services like S3, EBS, or RDS.
7. The attacker might then attempt to exfiltrate the encrypted data or hold it for ransom, impacting confidentiality and availability.

Impact

Successful exploitation could lead to unauthorized encryption of sensitive data within AWS, rendering it inaccessible to legitimate users without the attacker's keys. This could result in significant business disruption, data loss, and compliance violations. The number of affected resources would depend on the scope of the compromised access key's permissions and the attacker's objectives. The impact could range from encrypting a single critical database to locking down an entire AWS environment.

Recommendation

• Deploy the Sigma rule AWS IAM Key Creation with Encryption Policy but Without MFA to your SIEM to detect this specific activity.
• Enable and enforce MFA for all IAM users, especially those with administrative privileges or access to sensitive resources, to prevent unauthorized access key creation.
• Review IAM policies to ensure least privilege and limit the scope of access keys.
• Monitor AWS CloudTrail logs for suspicious IAM activity, including access key creation and policy attachments, as indicated by the logsource in the Sigma rules.