attack.t1059.009

AWS IAM S3Browser LoginProfile Creation

Aug 12, 2024 · attack.execution attack.persistence attack.t1059.009 attack.t1078.004 ·

Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.

AWS IAM S3Browser Templated S3 Bucket Policy Creation

Aug 12, 2024 · attack.execution attack.t1059.009 attack.persistence attack.t1078.004 ·

Share on:

Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "".

AWS IAM S3Browser User or AccessKey Creation

Aug 12, 2024 · attack.execution attack.persistence attack.t1059.009 attack.t1078.004 ·

Share on:

Detects S3 Browser utility creating IAM User or AccessKey.