Analytics BIOC
Informational
✕
A cloud identity invoked IAM related persistence operations
A cloud identity invoked IAM related persistence operations.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- AWS Audit Log, Azure Audit Log, Gcp Audit Log
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Account Manipulation (T1098) Create Account: Cloud Account (T1136.003) Valid Accounts: Cloud Accounts (T1078.004) Account Manipulation: Additional Cloud Credentials (T1098.001)
Attacker's goals:
Maintain persistence in cloud environments.
Investigative actions:
Check what API calls were executed by the identity. Check what cloud resources were affected. Look for signs that the identity is compromised.
- Test period:
- N/A (single event)
- Deduplication:
- 5 Days
2 variations:
- A cloud identity invoked compute instance related persistence operations Informational Adds Event Triggered Execution (T1546) Implant Internal Image (T1525)
- A cloud identity invoked compute function related persistence operations Informational Adds Event Triggered Execution (T1546)