Cloud user performed multiple actions that were denied

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	10 Minutes
Deduplication Period	5 Days
Required Data	Requires one of the following data sources: AWS Audit Log OR Azure Audit Log OR Gcp Audit Log
Detection Modules	Cloud
Detector Tags	OCI Analytics
ATT&CK Tactic	Discovery (TA0007)
ATT&CK Technique	Account Discovery (T1087), Permission Groups Discovery (T1069)
Severity	Informational

Description

An identity performed multiple actions that were denied, which may indicate it is being misused.

Attacker's Goals

Execute various commands to explore the cloud environment.

Investigative actions

Check if the API calls were made by the identity. Check if there are additional calls executed by the identity.

Variations

Cloud non-user identity performed multiple actions that were denied

Synopsis

Field	Value
ATT&CK Tactic	Discovery (TA0007)
ATT&CK Technique	Account Discovery (T1087), Permission Groups Discovery (T1069)
Severity	Low

Description

An identity performed multiple actions that were denied, which may indicate it is being misused.

Attacker's Goals

Execute various commands to explore the cloud environment.

Investigative actions

Check if the API calls were made by the identity. Check if there are additional calls executed by the identity.