CreateAccessKey

CSP: AWS

Tactics:

Persistence Credential Access

Techniques:

T1098T1098.001

Tags:

AWS IAM

Event

Creates a new long-term access key for an IAM user, enabling programmatic access to AWS services.

Security Context

• Creating long-lived access keys or credentials provides persistent access that survives password resets and session revocations.
• Accessing credential stores is a high-priority adversary objective that can unlock access to additional services, accounts, and environments.

Log Source

CloudTrail

Sample Event

MITRE ATT&CK Mapping

Tactics: Persistence Credential Access

Techniques:

• T1098 — Account Manipulation — Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.
• T1098.001 — Additional Cloud Credentials — Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment. For example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azu...