AWS IAM Principal Creation Followed by Policy Attachment
Detects when a new AWS IAM Principal (User, Role, or Group) is created and then has a policy attached to it by the same actor within a 10-minute time frame. This sequence is a suspicious TTP often used by attackers to provision a new, privileged "shadow" account or role for persistence and lateral movement, bypassing existing accounts or role assumption paths.
Splunk (SPL)
