Remote usage of an AWS service token

Analytics BIOC Low

Remote usage of an AWS service token

An AWS service token was used externally of the cloud environment.

Module:: Cortex Cloud
Licensed by:: Cloud Runtime Security (CRS)
Data source:: AWS Audit Log

ATT&CK tactics: Credential Access (TA0006) Lateral Movement (TA0008) Initial Access (TA0001)

ATT&CK techniques: Steal Application Access Token (T1528) Use Alternate Authentication Material: Application Access Token (T1550.001) Unsecured Credentials (T1552) Valid Accounts: Cloud Accounts (T1078.004)

Attacker's goals:

Exfiltrate a token and abuse it remotely.

Investigative actions:

Check what actions were executed using the access-key. Check if the IAM role was assumed by a different identity.

Test period:: N/A (single event)
Deduplication:: 5 Days

1 variation:

Suspicious usage of AWS service token Medium (parent: Low)