Analytics BIOC
Informational
✕
An unknown account was invited to the AWS organization
An unknown account was invited to your AWS organization. The target account was not seen in your tenant for the last 30 days.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- AWS Audit Log
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Account Manipulation (T1098)
Attacker's goals:
Establish persistent access to the compromised cloud account.
Investigative actions:
Identify the invited account ID and ownership. Review additional actions performed by the identity and role.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day