Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. tactic: TA0003 ✕ technique: T1078 ✕

Download CSV Show ATT&CK heatmap
  • An AWS database service master user password was changed Informational Cloud 2 variations

    An AWS database service master user password was changed.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    5 Days
    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Valid Accounts: Cloud Accounts (T1078.004)
    Required data: AWS Audit Log
    Detector tags: Cloud Data Asset Disaster Recovery Risks, Cloud Data Asset Stealth Tactics, Cloud Data Asset Configuration, Data Detection & Response
    Attacker's goals: Gain access and control of the database.
    Investigative actions: Confirm the identity intended to perform this action. Follow further actions done by the identity. Check what other changes were made to the AWS Database instance or cluster.

    Variations

    An AWS Database Service master user password was changed from an unusual country

    Low overridden

    An AWS database service master user password was changed. overridden

    An AWS Database Service master user password was changed by a non-DevOps identity

    Low overridden

    An AWS database service master user password was changed. overridden