Skip to content

Hide Navigation Hide TOC

AWS IAM S3Browser LoginProfile Creation (db014773-b1d3-46bd-ba26-133337c0ffee)

Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.

Cluster A Galaxy A Cluster B Galaxy B Level
AWS IAM S3Browser LoginProfile Creation (db014773-b1d3-46bd-ba26-133337c0ffee) Sigma-Rules Cloud API - T1059.009 (55bb4471-ff1f-43b4-88c1-c9384ec47abf) Attack Pattern 1
AWS IAM S3Browser LoginProfile Creation (db014773-b1d3-46bd-ba26-133337c0ffee) Sigma-Rules Cloud Accounts - T1078.004 (f232fa7a-025c-4d43-abc7-318e81a73d65) Attack Pattern 1
Cloud API - T1059.009 (55bb4471-ff1f-43b4-88c1-c9384ec47abf) Attack Pattern Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830) Attack Pattern 2
Valid Accounts - T1078 (b17a1a56-e99c-403c-8948-561df0cffe81) Attack Pattern Cloud Accounts - T1078.004 (f232fa7a-025c-4d43-abc7-318e81a73d65) Attack Pattern 2