attack.t1059.009

AWS IAM S3Browser LoginProfile Creation

Apr 28, 2026 · attack.execution attack.persistence attack.initial-access attack.privilege-escalation attack.stealth attack.t1059.009 attack.t1078.004 ·

Share on:

Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.

AWS IAM S3Browser Templated S3 Bucket Policy Creation

Apr 28, 2026 · attack.execution attack.stealth attack.t1059.009 attack.persistence attack.initial-access attack.privilege-escalation attack.t1078.004 ·

Share on:

Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "".

AWS IAM S3Browser User or AccessKey Creation

Apr 28, 2026 · attack.privilege-escalation attack.execution attack.persistence attack.initial-access attack.stealth attack.t1059.009 attack.t1078.004 ·

Share on:

Detects S3 Browser utility creating IAM User or AccessKey.