2026 Critical Cloud Control Plane Detection: Root or Privileged User Credential
Detects the creation or modification of credentials (access keys or login profiles) for the AWS root account or identities explicitly named to imply high-privilege administrative access. This is a high-fidelity indicator of persistence or unauthorized privilege escalation within an AWS environment.
Sigma
