Potential creation of persistent cloud credentials

Analytics BIOC Informational

Potential creation of persistent cloud credentials

A cloud identity invoked a credential-related persistence operation.

Module:: Cortex Cloud
Licensed by:: Cloud Runtime Security (CRS)
Data source:: AWS Audit Log

ATT&CK tactics: Persistence (TA0003) Credential Access (TA0006) Lateral Movement (TA0008)

ATT&CK techniques: Account Manipulation: Additional Cloud Credentials (T1098.001) Forge Web Credentials (T1606) Use Alternate Authentication Material: Application Access Token (T1550.001)

Attacker's goals:

Maintain persistence in cloud environments.

Investigative actions:

Check what API calls were executed by the identity. Check what resources are affected by this change. Look for signs that the user account is compromised (e.g. abnormal logins, unusual activity). Follow further actions done by the account.

Test period:: N/A (single event)
Deduplication:: 5 Days