Malicious AWS IAM Backdoor Users Keys (via cloudtrail)

title: Malicious AWS IAM Backdoor Users Keys (via cloudtrail)
id: 46b519a4-04e7-5682-b98d-a16718e50923
status: stable
description: This rule detects AWS API key creation for a user by another user. Backdoored users can be leveraged to obtain persistence in the AWS environment. Also with this alert, you can detect a flow of AWS keys in your org.
references:
    - https://attack.mitre.org/techniques/T1098/
    - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/iam__backdoor_users_keys/main.py
author: Huntrule Team
date: 2026-01-19
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1098
logsource:
    product: aws
    service: cloudtrail
detection:
    selection_source:
        eventSource: iam.amazonaws.com
        eventName: CreateAccessKey
    filter:
        userIdentity.arn|contains: responseElements.accessKey.userName
    condition: selection_source and not filter
falsepositives:
    - Unknown
level: medium