Elastic high stable kql

AWS IAM User Created Access Keys For Another User

An adversary with access to a set of compromised credentials may attempt to persist or escalate privileges by creating a new set of credentials for an existing user. This rule looks for use of the IAM `CreateAccessKey` API operation to create new programmatic access keys for another IAM user.

View Source

Detection Logic

from logs-aws.cloudtrail-* metadata _id, _version, _index
| where data_stream.dataset == "aws.cloudtrail"
    and event.provider == "iam.amazonaws.com"
    and event.action == "CreateAccessKey"
    and event.outcome == "success"
    and user.name != user.target.name
    and not to_lower(user_agent.original) like "*terraform*"
    and not to_lower(user_agent.original) like "*pulumi*"
    and not to_lower(user_agent.original) like "*ansible*"
| keep
    @timestamp,
    cloud.account.id,
    cloud.region,
    event.provider,
    event.action,
    event.outcome,
    data_stream.dataset,
    user.name,
    source.address,
    source.ip,
    user.target.name,
    user_agent.original,
    aws.cloudtrail.request_parameters,
    aws.cloudtrail.response_elements,
    aws.cloudtrail.user_identity.arn,
    aws.cloudtrail.user_identity.type,
    aws.cloudtrail.user_identity.access_key_id,
    source.geo.*,
    _id,
    _version,
    _index

False Positives

⚠ While this can be normal behavior, it should be investigated to ensure validity. Verify whether the user identity should be using the IAM `CreateAccessKey` for the targeted user.

Field Validations

Loading…

Comments (0)

Loading comments...