AWS User Login Profile Modified by Another User

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•32

Detects activity when an AWS user's login profile (password) is modified by another user. This can indicate an attacker with the "iam:UpdateLoginProfile" permission is changing passwords on behalf of other users to gain access to the AWS console.