Elastic low stable kql

AWS IAM Login Profile Added to User

Identifies when an AWS IAM login profile is added to a user. Adversaries may add a login profile to an IAM user who typically does not have one and is used only for programmatic access. This can be used to maintain access to the account even if the original access key is rotated or disabled. This is a building block rule and does not generate alerts on its own. It is meant to be used for correlation with other rules to detect suspicious activity.

View Source

Detection Logic

event.dataset: aws.cloudtrail and event.provider: "iam.amazonaws.com"
    and event.action: "CreateLoginProfile" and event.outcome: success
    and not user_agent.original: (*Terraform* or *Pulumi*)

Field Validations

Loading…

Comments (0)

Loading comments...