Analytics BIOC Low
✕

Unusual cross projects activity

A suspicious activity between different cloud projects.

Module:
Cortex Cloud
Licensed by:
Cloud Runtime Security (CRS)
Data source:
AWS Audit Log, Azure Audit Log, Gcp Audit Log
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Trusted Relationship (T1199)
Attacker's goals:

Abuse an existing connection and pivot through multiple projects to find their target.

Investigative actions:

Check if the identity intended to perform actions on the project. Check the operations that were performed on the project {caller_project}. Check if the identity performed additional operations in the cloud environment that might be malicious.

Test period:
N/A (single event)
Deduplication:
1 Day
1 variation:
  • Suspicious cross projects activity Medium (parent: Low)