Sunturai
Back to results
MediumSplunk security contentBhavin Patel +2Threat hunting

AWS CreateAccessKey

This hunting query identifies successful AWS IAM access key creation events where a named IAM user creates a key for a different named IAM user. Such activity may indicate persistence or privilege escalation,…

Description

This hunting query identifies successful AWS IAM access key creation events where a named IAM user creates a key for a different named IAM user. Such activity may indicate persistence or privilege escalation, particularly when the target user has elevated permissions. The query compares the caller and target usernames; it does not assess the target user's permissions. Hunting queries are designed to be run manually during threat hunting activities.

Detection logic

Detection requirements

Platform
IaaSIdentity ProviderOffice SuiteSaaS

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
aws_cloudtrail_createaccesskey

Known benign triggers

  • While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice