Analytics BIOC
Informational
✕
An IAM group was created
An IAM group was created.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- AWS Audit Log
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Create Account (T1136)
Attacker's goals:
Gain persistence through an IAM user who may be a member of the newly created group.
Investigative actions:
Review the group's permissions. Identify which users were added to the group.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day