Platform | Author | Last Update |
---|
aws | Nick Jones | 2024-12-02 |
An attacker may attempt to create an IAM user, in order to provide another means of authenticating to the AWS account
MITRE IDs
Required Permissions
Required Parameters
Name | Type | Description | Example Value |
---|
user | str | IAM user to create | example-user |
Attacker Action
Detection Case
ELK query
When logs are ingested into ELK, the following Lucene query can be used to identify relevant events.
Sigma Definition