AWS Privilege Escalation via IAM Access Key Creation and Immediate Use
This rule detects a specific privilege escalation scenario in AWS where a user creates a new access key for another user and then immediately uses that newly created access key from the same IP address to perform further actions. This behavior indicates an attempt to escalate privileges by leveraging a newly generated credential.
YARA-L
