2026 Critical Cloud Control Plane Detection: IAM Access Key Created for Root or Highly Privileged User
Detects the creation of an AWS IAM access key (CreateAccessKey) for the root account or identities with administrative naming conventions. This activity can indicate persistence establishment by an attacker who has gained high-privileged access, as new access keys provide a durable way to maintain programmatic control that bypasses standard session-based security controls.
Sigma
