A cloud identity executed an API call from an unusual country

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: AWS Audit Log OR Azure Audit Log OR Gcp Audit Log OR Kubernetes Audit Logs
Detection Modules	Cloud
Detector Tags	Kubernetes - API, OCI Analytics
ATT&CK Tactic	Initial Access (TA0001)
ATT&CK Technique	Valid Accounts (T1078)
Severity	Informational

Description

A cloud identity that normally connects from a limited set of countries connected from a new country for the first time.

Attacker's Goals

Access sensitive resources and gain high privileges.

Investigative actions

Check if the identity routed their traffic via a VPN or shared their credentials with a remote employee.

Variations

A suspicious cloud identity executed an API call from an unusual country

Synopsis

Field	Value
ATT&CK Tactic	Initial Access (TA0001)
ATT&CK Technique	Valid Accounts (T1078)
Severity	Medium

Description

A cloud identity that normally connects from a limited set of countries connected from a new country for the first time.

Attacker's Goals

Access sensitive resources and gain high privileges.

Investigative actions

Check if the identity routed their traffic via a VPN or shared their credentials with a remote employee.

A Kubernetes identity executed an API call from a country that was not seen in the organization

Synopsis

Field	Value
ATT&CK Tactic	Initial Access (TA0001)
ATT&CK Technique	Valid Accounts (T1078)
Severity	Medium

Description

A Kubernetes identity that normally connects from a limited set of countries connected from a new country for the first time.

Attacker's Goals

Access sensitive resources and gain high privileges.

Investigative actions

Check if the identity routed their traffic via a VPN or shared their credentials with a remote employee.

A cloud identity executed an API call from a country that was not seen in the organization

Synopsis

Field	Value
ATT&CK Tactic	Initial Access (TA0001)
ATT&CK Technique	Valid Accounts (T1078)
Severity	Medium

Description

A cloud identity that normally connects from a limited set of countries connected from a new country for the first time.

Attacker's Goals

Access sensitive resources and gain high privileges.

Investigative actions

Check if the identity routed their traffic via a VPN or shared their credentials with a remote employee.

A cloud identity executed an API call from an unusual country

Synopsis

Field	Value
ATT&CK Tactic	Initial Access (TA0001)
ATT&CK Technique	Valid Accounts (T1078)
Severity	Informational

Description

A cloud identity that normally connects from a limited set of countries connected from a new country for the first time.

Attacker's Goals

Access sensitive resources and gain high privileges.

Investigative actions

Check if the identity routed their traffic via a VPN or shared their credentials with a remote employee.

A Kubernetes API call was executed from an unusual country

Synopsis

Field	Value
ATT&CK Tactic	Initial Access (TA0001)
ATT&CK Technique	Valid Accounts (T1078)
Severity	Low

Description

A Kubernetes identity that normally connects from a limited set of countries connected from a new country for the first time.

Attacker's Goals

Access sensitive resources and gain high privileges.

Investigative actions

Check if the identity routed their traffic via a VPN or shared their credentials with a remote employee.

A cloud API call was executed from an unusual country

Synopsis

Field	Value
ATT&CK Tactic	Initial Access (TA0001)
ATT&CK Technique	Valid Accounts (T1078)
Severity	Low

Description

A cloud identity that normally connects from a limited set of countries connected from a new country for the first time.

Attacker's Goals

Access sensitive resources and gain high privileges.

Investigative actions

Check if the identity routed their traffic via a VPN or shared their credentials with a remote employee.

A cloud identity executed an API call from an unusual country using a compromised AWS access key

Synopsis

Field	Value
ATT&CK Tactic	Initial Access (TA0001)
ATT&CK Technique	Valid Accounts (T1078)
Severity	High

Description

A cloud identity that normally connects from a limited set of countries connected from a new country for the first time.

Attacker's Goals

Access sensitive resources and gain high privileges.

Investigative actions

Check if the identity routed their traffic via a VPN or shared their credentials with a remote employee.