AWS IAM Backdoor User Key Creation by Another User

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•30

This rule detects the creation of AWS API keys for a user by a different user. This activity is indicative of a backdoored user account being used to establish persistence within an AWS environment. It can also help identify unusual flows of AWS key creation within an organization.