Analytics BIOC Low
✕

Unusual AWS credentials creation

AWS utility was used to create an access key and a secret key.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Account Manipulation: Additional Cloud Credentials (T1098.001)
Attacker's goals:

Maintain access to an AWS provider.

Investigative actions:

Check the machine timeline and look for abnormal activity. Investigate what other calls were made to the AWS account.

Test period:
N/A (single event)
Deduplication:
1 Day