Analytics BIOC
Informational
✕
Cloud email sending was enabled
Cloud email sending was enabled for the cloud account.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- AWS Audit Log
ATT&CK tactics: Resource Development (TA0042)
ATT&CK techniques: Compromise Accounts: Email Accounts (T1586.002)
Attacker's goals:
Use the existing account to send phishing or spread malware.
Investigative actions:
Check if the identity has performed any email-related operations in the past. Check if this account should be used for email sending.
- Test period:
- N/A (single event)
- Deduplication:
- 5 Days
1 variation:
- Cloud email sending was enabled by an unusual identity Low (parent: Informational)