{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/key-creation/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["aws","iam","key-creation","mfa-bypass","persistence"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThis alert focuses on identifying potentially malicious activity within Amazon Web Services (AWS) environments where Identity and Access Management (IAM) users are creating new access keys and associating them with encryption-related policies without proper multi-factor authentication (MFA). This behavior could indicate an attacker attempting to establish persistent access to the AWS environment, bypass security controls, and potentially exfiltrate or encrypt data. Although the source does not specify the exact scope or targeting, this detection aims to identify a common tactic used in cloud-based attacks to escalate privileges and maintain unauthorized access. Identifying and investigating these events promptly is crucial for maintaining the security posture of AWS environments.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains initial access to an AWS account, possibly through compromised credentials or other means.\u003c/li\u003e\n\u003cli\u003eThe attacker attempts to create a new IAM user or utilizes an existing IAM user account.\u003c/li\u003e\n\u003cli\u003eThe attacker attempts to create a new IAM access key.\u003c/li\u003e\n\u003cli\u003eThe attacker attempts to assign an IAM policy to the user or key that grants permissions related to encryption services, such as KMS (Key Management Service).\u003c/li\u003e\n\u003cli\u003eThe attacker performs these actions without triggering MFA.\u003c/li\u003e\n\u003cli\u003eThe newly created key, if successful, is used to access AWS resources and services.\u003c/li\u003e\n\u003cli\u003eThe attacker leverages the encryption permissions to encrypt data, potentially for ransomware purposes, or to gain unauthorized access to encrypted resources.\u003c/li\u003e\n\u003cli\u003eThe attacker establishes persistence within the AWS environment, enabling long-term unauthorized access and control.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation could allow an attacker to gain persistent access to an AWS environment, bypass MFA controls, and escalate privileges. This can lead to unauthorized data access, exfiltration of sensitive information, or encryption of critical data for ransom. The impact ranges from data breaches and service disruption to significant financial losses. Identifying and mitigating such activities is critical for organizations relying on AWS infrastructure.\u003c/p\u003e\n","date_modified":"2024-01-09T12:00:00Z","date_published":"2024-01-09T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-09-aws-key-creation-no-mfa/","summary":"An AWS IAM user is creating keys and applying encryption policies without multi-factor authentication (MFA), potentially indicating an attempt to establish persistent access and bypass security controls.","title":"AWS IAM Key Creation with Encryption Policy but without MFA","url":"https://feed.craftedsignal.io/briefs/2024-01-09-aws-key-creation-no-mfa/"}],"language":"en","title":"CraftedSignal Threat Feed - Key-Creation","version":"https://jsonfeed.org/version/1.1"}