AWS IAM Activity by S3 Browser Utility

Google SecOps@GoogleSecOps

•updated Jan 30, 2025•1•0•45

This rule detects AWS IAM activities associated with the S3 Browser utility. Specifically, it looks for attempts to create new users (`CreateUser`), create login profiles (`CreateLoginProfile`), create access keys (`CreateAccessKey`), or put user policies (`PutUserPolicy`) within AWS IAM. The detection is triggered when these actions are performed and the HTTP user agent string in the CloudTrail log indicates the use of 'S3 Browser'. This combination of actions and user agent suggests potential account manipulation for persistence or privilege escalation within an AWS environment.