AWS CloudTrail: S3 Browser Creating IAM User or Access Key

title: "AWS CloudTrail: S3 Browser Creating IAM User or Access Key"
id: 52c64136-c7c0-457a-8c3a-5aca798566d6
status: test
description: This rule flags AWS CloudTrail events where the IAM service receives CreateUser or CreateAccessKey requests with a user agent containing "S3 Browser". Attackers may use such a utility to provision new IAM principals and credentials, enabling privilege escalation, persistence, or stealthy access. It relies on CloudTrail IAM event telemetry for eventSource, eventName, and the originating user agent string.
references:
  - https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_iam_s3browser_user_or_accesskey_creation.yml
author: daniel.bohannon@permiso.io (@danielhbohannon), Huntrule Team
date: 2023-05-17
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.initial-access
  - attack.stealth
  - attack.t1059.009
  - attack.t1078.004
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: iam.amazonaws.com
    eventName:
      - CreateUser
      - CreateAccessKey
    userAgent|contains: S3 Browser
  condition: selection
falsepositives:
  - Valid usage of S3 Browser for IAM User and/or AccessKey creation
level: high
license: DRL-1.1
related:
  - id: db014773-d9d9-4792-91e5-133337c0ffee
    type: derived