AWS IAM S3Browser User or AccessKey Creation

Title: AWS IAM S3Browser User or AccessKey Creation
Status: test
Description:Detects S3 Browser utility creating IAM User or AccessKey.
References:
  -https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor
Author: daniel.bohannon@permiso.io (@danielhbohannon)
Date: 2023-05-17
modified:None
Tags:

• -'attack.privilege-escalation'
• -'attack.execution'
• -'attack.persistence'
• -'attack.initial-access'
• -'attack.stealth'
• -'attack.t1059.009'
• -'attack.t1078.004'

Logsource:

• product: aws
• service: cloudtrail

Detection:
  selection:
    eventSource: 'iam.amazonaws.com'
    eventName:
      -'CreateUser'
      -'CreateAccessKey'

    userAgent|contains: 'S3 Browser'
  condition:selection
Falsepositives:
  -Valid usage of S3 Browser for IAM User and/or AccessKey creation
Level: high