// Microsoft Sentinel / Log Analytics. Read-only; not live-tested.
// Actions an attacker uses to stay, escalate or hide, by the key owner's identity.
let KeyOwnerArn = "REPLACE_WITH_IAM_USER_ARN";
let WindowStart = datetime(2026-01-01T00:00:00Z);  // REPLACE: first possible exposure, UTC
let Watched = dynamic(["CreateUser", "CreateAccessKey", "CreateLoginProfile",
    "UpdateLoginProfile", "AttachUserPolicy", "PutUserPolicy", "AddUserToGroup",
    "CreateRole", "UpdateAssumeRolePolicy", "AttachRolePolicy", "PutRolePolicy",
    "CreatePolicyVersion", "CreateOpenIDConnectProvider", "CreateSAMLProvider",
    "GetSessionToken", "GetFederationToken", "AssumeRole", "RunInstances",
    "CreateKeyPair", "ImportKeyPair", "AuthorizeSecurityGroupIngress",
    "PutBucketPolicy", "GetSecretValue", "StopLogging", "DeleteTrail", "UpdateTrail",
    "PutEventSelectors", "DeleteDetector", "LeaveOrganization"]);
AWSCloudTrail
| where TimeGenerated between (WindowStart .. now())
| where UserIdentityArn =~ KeyOwnerArn
| where EventName in (Watched) or EventName startswith "CreateFunction"
| project TimeGenerated, EventSource, EventName, ErrorCode, AWSRegion,
    SourceIpAddress, UserIdentityAccessKeyId, RequestParameters, ResponseElements
| order by TimeGenerated asc
| take 500