Invitation sent to account to join AWS organization

cloudtrail

Classification:

attack

Tactic:

TA0005-defense-evasion

Technique:

T1535-unused-or-unsupported-cloud-regions

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Goal

Detect when there is an attempt to invite an AWS account to an AWS organization.

Strategy

This rule allows you to monitor CloudTrail and detect if an attacker has attempted to invite an AWS account to an AWS organization. An attacker may attempt add an attacker controlled AWS account to a compromised AWS organization to evade the existing defenses of the organization.

This operation can be called only from the organization’s management account.

Triage and response

  1. Determine if {{@userIdentity.arn}} should have made a {{@evt.name}} API call.
    • Refer to @requestParameters.target.id to retrieve the account invited. This maybe in the form of an AWS account ID or email address.
    • Attempt to confirm the action either with the identity making the change or search for a ticket associated with the change.
    • Investigate other activities performed by the identity {{@userIdentity.arn}} using the Cloud SIEM - User Investigation dashboard.
  2. If the API call does not appear to be legitimate, begin your organization’s incident response process and investigate.