AWS IAM User or AccessKey Creation by S3 Browser

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•29

Detects the S3 Browser utility creating an IAM User or AccessKey in AWS. This activity can be indicative of an attacker establishing persistence or escalating privileges within an AWS environment.