AWS IAM S3Browser LoginProfile Creation

Title: AWS IAM S3Browser LoginProfile Creation
Status: test
Description:Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.
References:
  -https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor
Author: daniel.bohannon@permiso.io (@danielhbohannon)
Date: 2023-05-17
modified:None
Tags:

• -'attack.execution'
• -'attack.persistence'
• -'attack.initial-access'
• -'attack.privilege-escalation'
• -'attack.stealth'
• -'attack.t1059.009'
• -'attack.t1078.004'

Logsource:

• product: aws
• service: cloudtrail

Detection:
  selection:
    eventSource: 'iam.amazonaws.com'
    eventName:
      -'GetLoginProfile'
      -'CreateLoginProfile'

    userAgent|contains: 'S3 Browser'
  condition:selection
Falsepositives:
  -Valid usage of S3 Browser for IAM LoginProfile listing and/or creation
Level: high