AWS IAM Roles Anywhere User Profile Creation

cloudtrail

Classification:

attack

Tactic:

TA0003-persistence

Technique:

T1098-account-manipulation

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Goal

Detect when an IAM Roles Anywhere profile is created.

Strategy

This rule monitors CloudTrail logs for CreateProfile API calls. An attacker may attempt to create a profile, a list of the roles that the AWS IAM Roles Anywhere service is trusted to assume. Profiles are used to intersect permissions with IAM managed policies.

Triage & response

  1. Determine if the API call {{@evt.name}} should have been performed by the user {{@userIdentity.arn}}:
    • Contact the user to confirm if they made the API call.
  2. If the API call was not made by the user:
    • Rotate the user credentials.
    • Determine what actions the user took and which new access keys the user created.
    • Begin your organization’s incident response process and investigate.

References