Threat Hunting AWS CloudTrail with Microsoft Sentinel: Part 4

This report demonstrates adversary emulation in AWS using Atomic Red Team to simulate IAM-focused actions (CreateUser, CreateAccessKey, CreateGroup) and shows how to hunt and detect these behaviors in Microsoft Sentinel via KQL over CloudTrail logs. It provides step-by-step execution and corresponding detection queries for suspicious source IPs, user agents (e.g., Kali), and admin actions (notably by user “Jacko”), culminating in a consolidated hunt for IAM user creation, access key issuance, and group creation. The guidance concludes with SOC-focused recommendations to alert on new IAM users, access key creation, and group/policy changes to reduce false positives and enhance cloud monitoring efficacy.