Analytics BIOC
Informational
✕
A compute-attached identity executed API calls outside the instance's region
A compute-attached identity performed actions outside the compute instance region.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- AWS Audit Log
ATT&CK tactics: Initial Access (TA0001) Credential Access (TA0006)
ATT&CK techniques: Valid Accounts: Cloud Accounts (T1078.004) Steal Application Access Token (T1528) Unsecured Credentials (T1552)
Attacker's goals:
Exfiltrate token and abuse it remotely.
Investigative actions:
Verify whether the compute-attached identity's credentials were intentionally used remotely. Check what API calls were executed using instance's attached role. Check if the suspected instance is compromised.
- Test period:
- N/A (single event)
- Deduplication:
- 5 Days
6 variations:
- A compute-attached identity executed API calls outside the Lambda function's region Informational
- A compute-attached identity executed API calls outside the instance's region from an unusual geolocation and ASN High (parent: Informational)
- A compute-attached identity executed API calls outside the instance's region from an unusual geolocation Medium (parent: Informational)
- A compute-attached identity executed API calls outside the instance's region from an unusual ASN Low (parent: Informational)
- A compute-attached identity executed API calls outside the instance's region Low (parent: Informational)
- A compute-attached identity failed to execute API calls outside the instance's region Informational