GuardDuty IAM Credential Abuse Followed by Cryptomining (T1078/T1496)
This rule detects a correlation between an unauthorized IAM user access event and the subsequent execution of cryptocurrency mining tools within the same AWS account within a one-hour window. This is a strong indicator of an adversary leveraging compromised cloud credentials to perform resource hijacking.
CQL
