Analytics BIOC
Low
✕
Suspicious usage of EC2 token
An AWS EC2 STS token was used externally from an EC2 instance.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- AWS Audit Log
ATT&CK tactics: Credential Access (TA0006) Initial Access (TA0001)
ATT&CK techniques: Steal Application Access Token (T1528) Unsecured Credentials (T1552) Valid Accounts: Cloud Accounts (T1078.004)
Attacker's goals:
Exfiltrate token and abuse it remotely.
Investigative actions:
Check if the access key was generated by the attached instance. Check what actions were executed by the access key. Check if the relevant instance is compromised.
- Test period:
- N/A (single event)
- Deduplication:
- 5 Days
1 variation:
- Suspicious usage of EC2 token Medium (parent: Low)