A cloud identity invoked IAM related persistence operations

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	Requires one of the following data sources: AWS Audit Log OR Azure Audit Log OR Gcp Audit Log
Detection Modules	Cloud
ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Account Manipulation (T1098), Create Account: Cloud Account (T1136.003), Valid Accounts: Cloud Accounts (T1078.004), Account Manipulation: Additional Cloud Credentials (T1098.001)
Severity	Informational

Description

A cloud identity invoked IAM related persistence operations.

Attacker's Goals

Maintain persistence in cloud environments.

Investigative actions

• Check what API calls were executed by the identity.
• Check what cloud resources were affected.
• Look for signs that the identity is compromised.

Variations

A cloud identity invoked compute instance related persistence operations

Synopsis

Field	Value
ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Event Triggered Execution (T1546), Implant Internal Image (T1525), Account Manipulation: Additional Cloud Credentials (T1098.001)
Severity	Informational

Description

A cloud identity invoked compute instance related persistence operations.

Attacker's Goals

Maintain persistence in cloud environments.

Investigative actions

• Check what API calls were executed by the identity.
• Check what cloud resources were affected.
• Look for signs that the identity is compromised.

A cloud identity invoked compute function related persistence operations

Synopsis

Field	Value
ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Event Triggered Execution (T1546)
Severity	Informational

Description

A cloud identity invoked compute function related persistence operations.

Attacker's Goals

Maintain persistence in cloud environments.

Investigative actions

• Check what API calls were executed by the identity.
• Check what cloud resources were affected.
• Look for signs that the identity is compromised.