Analytics BIOC
Low
✕
AWS IAM Role Created with Cross-Account Access
A cloud identity has created a new IAM role with trust policy that allows external AWS account access.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- AWS Audit Log
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Account Manipulation: Additional Cloud Roles (T1098.003) Account Manipulation (T1098)
Attacker's goals:
Obtaining persistency by assuming a role in the target's environment.
Investigative actions:
Investigate any unusual activity originating from the suspected identity. Investigate any unusual activity performed in the assumed role sessions when originating from the allowed added accounts. Validate the legitimacy of the AWS accounts that were allowed external access.
- Test period:
- N/A (single event)
- Deduplication:
- 5 Days
1 variation:
- AWS IAM Role Created with Cross-Account Access using CloudFormation Informational (parent: Low)