CreateUser
AWS
CreateUser
Event
Creates a new IAM user in the AWS account for programmatic or console-based access.
Security Context
- Account manipulation is a primary persistence technique, allowing adversaries to maintain access through modified permissions or credentials.
- Creating cloud accounts provides a durable backdoor that persists independently of any compromised user’s credentials.
Log Source
CloudTrail
Sample Event
Adversarial. Draco creates a backdoor IAM user named luna (matching the persona convention for new-user targets). The username is deliberately chosen to match a real planned new hire (the onboarding contractor) so that follow-on activity tied to luna blends into legitimate onboarding traffic. Subsequent events in the chain: AttachUserPolicy (admin), CreateAccessKey (long-term creds), CreateLoginProfile (console access). All four events together provide robust persistence.
{ "eventVersion": "1.09", "userIdentity": { "type": "IAMUser", "principalId": "AIDADRAC0MALF0YBADGY", "arn": "arn:aws:iam::555123456789:user/draco", "accountId": "555123456789", "accessKeyId": "AKIADRAC0MALF0YEXAMP5", "userName": "draco", "sessionContext": { "attributes": { "creationDate": "2026-04-15T18:51:02Z", "mfaAuthenticated": "false" } } }, "eventTime": "2026-04-16T01:31:08Z", "eventSource": "iam.amazonaws.com", "eventName": "CreateUser", "awsRegion": "us-east-1", "sourceIPAddress": "203.0.113.66", "userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6", "requestParameters": { "userName": "luna" }, "responseElements": { "user": { "path": "/", "userName": "luna", "userId": "AIDA0666LUNA0BACKDOOR", "arn": "arn:aws:iam::555123456789:user/luna", "createDate": "Apr 16, 2026, 1:31:08 AM" } }, "requestID": "90000000-0000-4000-8000-000010100100", "eventID": "90000000-0000-4000-8000-000010100101", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "555123456789", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "iam.amazonaws.com" }}MITRE ATT&CK Mapping
Tactics: Persistence
Techniques:
- T1136.003 — Cloud Account — Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.
- T1098 — Account Manipulation — Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include accoun...