Classification:

attack

Tactic:

TA0001-initial-access

Technique:

T1078-valid-accounts

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detect when a user attempts to access the OCI console an anomalous amount of times.

Strategy

This rule monitors OCI to detect the 404 error message.

Triage and response

1. Determine if {{@user.name}} should be attempting to use the identified API calls: {{@evt.name}}.
2. Contact the user to see if they intended to make these API calls.
3. If the user did not make the API calls:
   • Rotate the credentials.
   • Investigate which unauthorized API calls might have succeeded throughout the rest of the environment.