An unknown account was invited to the AWS organization

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	AWS Audit Log
Detection Modules	Cloud
ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Account Manipulation (T1098)
Severity	Informational

Description

An unknown account was invited to your AWS organization. The target account was not seen in your tenant for the last 30 days.

Attacker's Goals

Establish persistent access to the compromised cloud account.

Investigative actions

• Identify the invited account ID and ownership.
• Review additional actions performed by the identity and role.