IAM Enumeration sequence

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	10 Minutes
Deduplication Period	7 Days
Required Data	Requires one of the following data sources: AWS Audit Log OR Gcp Audit Log
Detection Modules	Cloud
Detector Tags
ATT&CK Tactic	Discovery (TA0007)
ATT&CK Technique	Account Discovery (T1087) Permission Groups Discovery (T1069) Cloud Service Discovery (T1526)
Severity	Informational

An Identity has executed a sequence of events which may be related to an IAM recon enumeration.

Gain information on the Cloud environment, specifically IAM information such as User, Group, Roles, Policies etc.

Check if the API calls were made by the identity.
Check if there are additional calls executed by the identity.

ATT&CK Tactic

ATT&CK Technique

Severity

Low

A cloud Internet facing instance performed an unusual IAM enumeration.

Gain information on the Cloud environment, specifically IAM information such as User, Group, Roles, Policies etc.

Check if the API calls were made by the identity.
Check if there are additional calls executed by the identity.