Analytics
Informational
✕
IAM Enumeration sequence
An identity has executed a sequence of events which may be related to an IAM recon enumeration.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- AWS Audit Log, Gcp Audit Log
ATT&CK tactics: Discovery (TA0007)
ATT&CK techniques: Account Discovery (T1087) Permission Groups Discovery (T1069) Cloud Service Discovery (T1526)
Attacker's goals:
Gather information about the cloud environment, including IAM users, groups, roles, and policies.
Investigative actions:
Verify whether the API calls were made by the identity and check for any additional related calls.
- Test period:
- 10 Minutes
- Deduplication:
- 7 Days
1 variation:
- IAM Enumeration sequence executed from a cloud Internet facing instance Low (parent: Informational)