title: AWS IAM Persistence Activity Possibly Using Exposed Access Key
id: 2f0b7c3e-6a41-4c1e-9b8a-1d2e3f4a5b01
status: experimental
description: IAM user/key/role/policy creation listed in Railway's 2026-10-22 guidance as signs of misuse of exposed AWS keys. Baseline against your own automation.
references:
    - https://blog.railway.com/p/security-disclosure-recommendation-check-for-anomalous-aws-access
author: Defensive detection pack
date: 2026-10-22
tags:
    - attack.persistence
    - attack.t1098.001
    - attack.t1136.003
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: iam.amazonaws.com
        eventName:
            - CreateUser
            - CreateAccessKey
            - AttachUserPolicy
            - PutUserPolicy
            - CreateLoginProfile
            - CreateRole
            - AttachRolePolicy
            - PutRolePolicy
            - UpdateAssumeRolePolicy
    condition: selection
falsepositives:
    - Legitimate IaC pipelines and administrators
level: medium