Analytics BIOC Informational
✕

Unusual AWS CLI/SDK activity

A cloud identity invoked an API using AWS CLI/SDK for the first time.

Module:
Cortex Cloud
Licensed by:
Cloud Runtime Security (CRS)
Data source:
AWS Audit Log
ATT&CK tactics: Execution (TA0002)
ATT&CK techniques: Command and Scripting Interpreter: Cloud API (T1059.009)
Attacker's goals:

Abuse cloud APIs to execute malicious commands.

Investigative actions:

Investigate any unusual activity originating from the suspected identity.

Test period:
N/A (single event)
Deduplication:
5 Days