Potential creation of persistent cloud credentials

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	AWS Audit Log
Detection Modules	Cloud
ATT&CK Tactic	Persistence (TA0003), Credential Access (TA0006), Lateral Movement (TA0008)
ATT&CK Technique	Account Manipulation: Additional Cloud Credentials (T1098.001), Forge Web Credentials (T1606), Use Alternate Authentication Material: Application Access Token (T1550.001)
Severity	Informational

Description

A cloud identity invoked a credential-related persistence operation.

Attacker's Goals

Maintain persistence in cloud environments.

Investigative actions

• Check what API calls were executed by the identity.
• Check what resources are affected by this change.
• Look for signs that the user account is compromised (e.g. abnormal logins, unusual activity).
• Follow further actions done by the account.