Analytics BIOC Informational
✕

Unusual key management activity

A cloud identity performed a key management operation for the first time.

Module:
Cortex Cloud
Licensed by:
Cloud Runtime Security (CRS)
Data source:
AWS Audit Log, Azure Audit Log, Gcp Audit Log
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: Unsecured Credentials (T1552)
Attacker's goals:

Abuse exposed cryptographic keys to decrypt sensitive information or create digital signatures to craft malicious messages. Using the decrypted information, the attacker may perform additional activities in an evasive manner.

Investigative actions:

Check the identity's role designation in the organization. Verify that the identity did not perform any sensitive KMS operation that it shouldn't.

Test period:
N/A (single event)
Deduplication:
1 Day