AWS Administrative IAM User Created

Description

Identifies when an Administrative IAM user is creates. This could indicate a potential security breach.

Query

Detection:
    - Group:
        - ID: CreateUser
          RuleID: AWS.IAM.CreateUser
        - ID: AttachAdminUserPolicy
          RuleID: AWS.IAM.AttachAdminUserPolicy
      MatchCriteria:
        field_name:
          - GroupID: CreateUser
            Match: p_alert_context.request_username
          - GroupID: AttachAdminUserPolicy
            Match: p_alert_context.request_username
      LookbackWindowMinutes: 1800
      Schedule:
        RateMinutes: 1440
        TimeoutMinutes: 5

Rule dependencies

⚠ Higher-order rule. It fires on other rules' alerts, not on raw events, so it cannot fire on its own. Deploy the rules it depends on too.

Depends on

Raw source AWS Administrative IAM User Created · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: correlation_rule
RuleID: "AWS.Administrative.IAM.User.Created.Group"
DisplayName: "AWS Administrative IAM User Created"
Enabled: false
Severity: Info
Tags:
  - Beta
Description: Identifies when an Administrative IAM user is creates. This could indicate a potential security breach.
Reference: https://stratus-red-team.cloud/attack-techniques/AWS/aws.persistence.iam-create-admin-user/
Reports:
  MITRE ATT&CK:
    - TA0006:T1078
Detection:
    - Group:
        - ID: CreateUser
          RuleID: AWS.IAM.CreateUser
        - ID: AttachAdminUserPolicy
          RuleID: AWS.IAM.AttachAdminUserPolicy
      MatchCriteria:
        field_name:
          - GroupID: CreateUser
            Match: p_alert_context.request_username
          - GroupID: AttachAdminUserPolicy
            Match: p_alert_context.request_username
      LookbackWindowMinutes: 1800
      Schedule:
        RateMinutes: 1440
        TimeoutMinutes: 5
Tests:
    - Name: User Created, Followed By Admin Policy Attachment
      ExpectedResult: true
      RuleOutputs:
        - ID: CreateUser
          Matches:
            p_alert_context.request_username:
              'new-user':
                - "2024-06-01T10:00:01Z"
        - ID: AttachAdminUserPolicy
          Matches:
            p_alert_context.request_username:
              'new-user':
                - "2024-06-01T10:30:01Z"
    - Name: User Created, Not Followed By Admin Policy Attachment
      ExpectedResult: false
      RuleOutputs:
        - ID: CreateUser
          Matches:
            p_alert_context.request_username:
              'new-user':
                - "2024-06-01T10:00:01Z"
    - Name: Wrong match
      ExpectedResult: false
      RuleOutputs:
        - ID: CreateUser
          Matches:
            p_alert_context.request_username:
              'new-user':
                - "2024-06-01T10:00:01Z"
        - ID: AttachAdminUserPolicy
          Matches:
            p_alert_context.request_username:
              'not-new-user':
                - "2024-06-01T11:00:01Z"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.