title: AWS IAM Credential, Policy or MFA Changes\nid: 2c6b0f4e-6a1d-4a2e-9f0b-3d7c1e9a8b52\nstatus: experimental\ndescription: Detects creation of long-lived AWS credentials, inline policy or group changes, and MFA deactivation for an IAM user.\nauthor: WMouton\ndate: 2026/10/05\ntags:\n    - attack.persistence\n    - attack.t1098.001\n    - attack.privilege_escalation\n    - attack.t1098.003\n    - attack.defense_evasion\n    - attack.t1556.006\nlogsource:\n    product: aws\n    service: cloudtrail\ndetection:\n    selection_credential:\n        eventSource: iam.amazonaws.com\n        eventName:\n            - CreateAccessKey\n            - CreateLoginProfile\n            - UpdateLoginProfile\n            - CreateServiceSpecificCredential\n    selection_policy:\n        eventSource: iam.amazonaws.com\n        eventName:\n            - AttachUserPolicy\n            - AttachGroupPolicy\n            - PutUserPolicy\n            - PutGroupPolicy\n            - CreatePolicyVersion\n            - AddUserToGroup\n    selection_mfa:\n        eventSource: iam.amazonaws.com\n        eventName:\n            - DeactivateMFADevice\n            - DeleteVirtualMFADevice\n    condition: 1 of selection_*\nfalsepositives:\n    - Legitimate IAM administration by a documented pipeline or platform team\n    - Break-glass or onboarding actions during an incident, which should still be rare\nlevel: high