Cloud user performed multiple actions that were denied

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-09-24

Activation Period	14 Days
Training Period	30 Days
Test Period	10 Minutes
Deduplication Period	5 Days
Required Data	Requires one of the following data sources: AWS Audit Log OR Azure Audit Log OR Gcp Audit Log
Detection Modules	Cloud
Detector Tags
ATT&CK Tactic	Discovery (TA0007)
ATT&CK Technique	Account Discovery (T1087) Permission Groups Discovery (T1069)
Severity	Informational

An Identity performed multiple actions that were denied, which may indicate it is being misused.

Execute a verity of commands to explore the cloud environment.

Check if the API calls were made by the identity.
Check if there are additional calls executed by the identity.

ATT&CK Tactic

ATT&CK Technique

Severity

Low

An Identity performed multiple actions that were denied, which may indicate it is being misused.

Execute a verity of commands to explore the cloud environment.

Check if the API calls were made by the identity.
Check if there are additional calls executed by the identity.