AWS Security Group remote access allowed from an unknown external IP address

Analytics BIOC Low

AWS Security Group remote access allowed from an unknown external IP address

A cloud identity has modified the ingress rules to allow unfamiliar ip addresses SSH or RDP access.

Module:: Cortex Cloud
Licensed by:: Cloud Runtime Security (CRS)
Data source:: AWS Audit Log

ATT&CK tactics: Defense Evasion (TA0005)

ATT&CK techniques: Impair Defenses: Disable or Modify Cloud Firewall (T1562.007)

Attacker's goals:

Obtaining persistency persistence by creating a direct, reliable backdoor that allows them to remotely control the system without needing to re-exploit it.

Investigative actions:

Investigate any unusual activity originating from the suspected identity and any activity performed from the newly added ip addresses.

Test period:: N/A (single event)
Deduplication:: 1 Day