This detection rule targets a credential-compromise/persistence pattern in AWS IAM. It looks for an IAM user who uses an existing access key (Token A) to create a new access key for the same user (Token B), and then uses Token B to make an AWS API request within one hour. The rule relies on CloudTrail data to correlate the creation event (CreateAccessKey) and the subsequent use of the newly created key, linking via the affected IAM user and the access key IDs. The correlation logic enforces a short window (≤ 3600 seconds) and requires both a creation and a subsequent use event to occur, which reduces noise from ordinary, legitimate credential rotation workflows. This pattern is indicative of an adversary attempting to establish a new long-term credential for persistence after compromising an existing key. The rule includes guidance for triage, investigation steps, and remediation actions to contain and remediate the threat.