Enumerate IAM users¶

Platform	Author	Last Update
aws	Nick Jones	2023-07-01

An adversary may attempt to enumerate the configured IAM users within an account, to identify entities that they might wish to gain access to or backdoor.

MITRE IDs¶

T1033

Required Permissions¶

iam:ListUsers

Required Parameters¶

None

Attacker Action¶

aws iam list-users

Detection Case¶

ELK query¶

When logs are ingested into ELK, the following Lucene query can be used to identify relevant events.

eventName:ListUsers AND eventSource:*.iam.amazonaws.com

Sigma Definition¶

---
title: Enumerate IAM users
id: 329a2783-4410-47b2-a113-36200ab1037a
status: experimental
author: Nick Jones
date: 2023-07-01
description: An adversary may attempt to enumerate the configured IAM users within an account, to identify entities that they might wish to gain access to or backdoor.
logsource:
  service: cloudtrail
detection:
  selection_source:
    - eventSource: "*.iam.amazonaws.com"
  events:
    - eventName: "ListUsers"
  condition: selection_source AND events
level: low
tags:
  - attack.T1033