AWS Stolen Developer Credential Use: Impossible Travel and High-Privilege API Abuse (T1078.004)

Ibrahim Saud@tektrix

•updated Jun 26, 2026•1•0•5

This rule detects potentially suspicious AWS API activity by identifying IAM identities that perform high-privilege operations or use developer-oriented user agents (e.g., boto3, python-requests) from multiple distinct IP addresses within a one-hour window. It calculates a risk score based on the combination of source IP diversity, developer tool usage, and the presence of sensitive API calls such as CreateUser, CreateAccessKey, RunInstances, and AssumeRole.