AWS IAM Backdoor Users Keys

calendar Sep 3, 2026 · attack.persistence attack.privilege-escalation attack.t1098  ·
Share on: linkedin copy

Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS environment. Also with this alert, you can detect a flow of AWS keys in your org.

Sigma rule (View on GitHub)

 1title: AWS IAM Backdoor Users Keys
 2id: 0a5177f4-6ca9-44c2-aacf-d3f3d8b6e4d2
 3status: test
 4description: |
 5  Detects AWS API key creation for a user by another user.
 6  Backdoored users can be used to obtain persistence in the AWS environment.
 7  Also with this alert, you can detect a flow of AWS keys in your org.  
 8references:
 9    - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/iam__backdoor_users_keys/main.py
10    - https://github.com/SigmaHQ/sigma/issues/6223
11author: faloker
12date: 2020-02-12
13modified: 2026-08-14
14tags:
15    - attack.persistence
16    - attack.privilege-escalation
17    - attack.t1098
18logsource:
19    product: aws
20    service: cloudtrail
21detection:
22    selection:
23        eventSource: iam.amazonaws.com
24        eventName: CreateAccessKey
25    filter_main_same_user:
26        userIdentity.arn|fieldref|contains: responseElements.accessKey.userName
27    condition: selection and not 1 of filter_main_*
28falsepositives:
29    - Adding user keys to their own accounts (the filter cannot cover all possible variants of user naming)
30    - AWS API keys legitimate exchange workflows
31level: medium

References

Related rules

to-top