AWS CloudTrail: S3 Browser enumerating IAM LoginProfiles and creating missing profiles

title: "AWS CloudTrail: S3 Browser enumerating IAM LoginProfiles and creating missing profiles"
id: 3baa69a2-0ec3-446f-9038-367a718355cb
status: test
description: This rule identifies CloudTrail events from an S3 Browser user agent that first queries IAM LoginProfiles (GetLoginProfile) and then creates IAM LoginProfiles (CreateLoginProfile). Attackers can use this pattern to probe for existing configurations and establish or persist access by creating new LoginProfiles where they do not exist. The detection relies on AWS CloudTrail IAM API events (eventSource iam.amazonaws.com) for GetLoginProfile and CreateLoginProfile, filtered by userAgent containing "S3 Browser".
references:
  - https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_iam_s3browser_loginprofile_creation.yml
author: daniel.bohannon@permiso.io (@danielhbohannon), Huntrule Team
date: 2023-05-17
tags:
  - attack.execution
  - attack.persistence
  - attack.initial-access
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1059.009
  - attack.t1078.004
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: iam.amazonaws.com
    eventName:
      - GetLoginProfile
      - CreateLoginProfile
    userAgent|contains: S3 Browser
  condition: selection
falsepositives:
  - Valid usage of S3 Browser for IAM LoginProfile listing and/or creation
level: high
license: DRL-1.1
related:
  - id: db014773-b1d3-46bd-ba26-133337c0ffee
    type: derived