AWS IAM credential, policy and MFA changes

Threat behaviour covered

After gaining a foothold in a cloud account, an attacker usually turns identity into persistence. They create a long-lived access key or console profile, attach an inline policy or add the principal to a group to widen what it can do, or switch off MFA so a password alone is enough. Each of these is a durable change that survives a password reset, so each is worth an alert on its own.

Detection logic

title: AWS IAM Credential, Policy or MFA Changes\nid: 2c6b0f4e-6a1d-4a2e-9f0b-3d7c1e9a8b52\nstatus: experimental\ndescription: Detects creation of long-lived AWS credentials, inline policy or group changes, and MFA deactivation for an IAM user.\nauthor: WMouton\ndate: 2026/10/05\ntags:\n    - attack.persistence\n    - attack.t1098.001\n    - attack.privilege_escalation\n    - attack.t1098.003\n    - attack.defense_evasion\n    - attack.t1556.006\nlogsource:\n    product: aws\n    service: cloudtrail\ndetection:\n    selection_credential:\n        eventSource: iam.amazonaws.com\n        eventName:\n            - CreateAccessKey\n            - CreateLoginProfile\n            - UpdateLoginProfile\n            - CreateServiceSpecificCredential\n    selection_policy:\n        eventSource: iam.amazonaws.com\n        eventName:\n            - AttachUserPolicy\n            - AttachGroupPolicy\n            - PutUserPolicy\n            - PutGroupPolicy\n            - CreatePolicyVersion\n            - AddUserToGroup\n    selection_mfa:\n        eventSource: iam.amazonaws.com\n        eventName:\n            - DeactivateMFADevice\n            - DeleteVirtualMFADevice\n    condition: 1 of selection_*\nfalsepositives:\n    - Legitimate IAM administration by a documented pipeline or platform team\n    - Break-glass or onboarding actions during an incident, which should still be rare\nlevel: high

Data sources

• AWS CloudTrail management events delivered to your SIEM (CloudTrail Lake, EventBridge, or a shipper). The rule reads control-plane API calls, not application or data-plane activity.

False positives and tuning

• Platform teams and CI pipelines legitimately create keys and attach policies. Allow-list the specific principals that own identity, and alert on everyone else.
• Joiner, mover and leaver automation will trip AddUserToGroup and policy changes; correlate with the change ticket or the automation role.
• Raise severity for MFA deactivation and for key creation by a principal that never created one before; those are the ones worth waking someone for.

Limitations

• It flags the change, not the intent: a key created legitimately and an attacker’s key look identical at this level. Follow-up should check the key’s source address and first use.
• It sees only what CloudTrail records. Activity through an already-consented third-party application may appear under that application’s principal and needs the consent-aware detections that go with the cloud identity range.
• Multi-account estates need the organisation trail; a per-account trail misses events in accounts without it.