Analytics BIOC Informational
✕

AWS user creation

A new AWS user was created.

Module:
Cortex Cloud
Licensed by:
Cloud Runtime Security (CRS)
Data source:
AWS Audit Log
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Create Account: Cloud Account (T1136.003)
Attacker's goals:

Maintaining persistence by creating backdoor users or malicious resources, ensuring ongoing access even if their initial entry is detected.

Investigative actions:

Check which user was created. Investigate the created user role and permissions. Verify the user who created the new identity is aware of this action. Be aware of any suspicious activity originating from the new user.

Test period:
N/A (single event)
Deduplication:
1 Day