Invitation sent to account to join AWS organization

cloudtrail

Classification:

attack

Tactic:

TA0005-defense-evasion

Technique:

T1535-unused-or-unsupported-cloud-regions

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Goal

Detect when there is an attempt to invite an AWS account to an AWS organization.

Strategy

This rule allows you to monitor CloudTrail and detect if an attacker has attempted to invite an AWS account to an AWS organization. An attacker may attempt add an attacker controlled AWS account to a compromised AWS organization to evade the existing defenses of the organization.

This operation can be called only from the organization’s management account.

Triage and response

  1. Determine if {{@userIdentity.arn}} should have made a {{@evt.name}} API call.
    • Refer to @requestParameters.target.id to retrieve the account invited. This maybe in the form of an AWS account ID or email address.
    • Attempt to confirm the action either with the identity making the change or search for a ticket associated with the change.
    • Investigate other activities performed by the identity {{@userIdentity.arn}} using the Cloud SIEM - User Investigation dashboard.
  2. If the API call does not appear to be legitimate, begin your organization’s incident response process and investigate.