AWS CloudTrail: IAM CreateAccessKey for Another User (Potential Backdoor Keys)

Identifies AWS access key creation where the requester is different from the access key’s target user.

FreeUnreviewedSigmamediumv1

aws-cloudtrail-iam-createaccesskey-for-another-user-potential-backdoor-keys-0a5177f4

title: "AWS CloudTrail: IAM CreateAccessKey for Another User (Potential Backdoor Keys)"
id: 7cb6e3e5-335a-4093-8f3d-95d88e3179cb
status: test
description: This rule flags CloudTrail events where an AWS access key is created for a user by a different user identity, using CreateAccessKey activity. Creating keys for other principals can establish unauthorized access and enable persistence or privilege escalation within the AWS environment. Detection relies on CloudTrail eventSource/eventName telemetry and compares the event’s user identity against the access key’s associated username in responseElements.
references:
  - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/iam__backdoor_users_keys/main.py
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_iam_backdoor_users_keys.yml
author: faloker, Huntrule Team
date: 2020-02-12
modified: 2022-10-09
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1098
logsource:
  product: aws
  service: cloudtrail
detection:
  selection_source:
    eventSource: iam.amazonaws.com
    eventName: CreateAccessKey
  filter:
    userIdentity.arn|contains: responseElements.accessKey.userName
  condition: selection_source and not filter
falsepositives:
  - Adding user keys to their own accounts (the filter cannot cover all possible variants of user naming)
  - AWS API keys legitimate exchange workflows
level: medium
license: DRL-1.1
related:
  - id: 0a5177f4-6ca9-44c2-aacf-d3f3d8b6e4d2
    type: derived

What it detects

This rule flags CloudTrail events where an AWS access key is created for a user by a different user identity, using CreateAccessKey activity. Creating keys for other principals can establish unauthorized access and enable persistence or privilege escalation within the AWS environment. Detection relies on CloudTrail eventSource/eventName telemetry and compares the event’s user identity against the access key’s associated username in responseElements.

Known false positives

Adding user keys to their own accounts (the filter cannot cover all possible variants of user naming)
AWS API keys legitimate exchange workflows

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.