AWS IAM S3Browser LoginProfile Creation

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•25

Detects the S3 Browser utility performing reconnaissance by checking for existing AWS IAM Users without a LoginProfile defined, and subsequently creating a LoginProfile if one is not found. This behavior has been associated with the Guivil threat actor.