Unusual cloud identity impersonation

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-09-24

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	Requires one of the following data sources: AWS Audit Log OR Gcp Audit Log
Detection Modules	Cloud
Detector Tags
ATT&CK Tactic	Privilege Escalation (TA0004) Defense Evasion (TA0005)
ATT&CK Technique	Valid Accounts: Cloud Accounts (T1078.004) Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access (T1548.005)
Severity	Informational

A cloud identity attempted to impersonate another identity for the first time.

Check the identity's designation.
Verify that the identity did not perform any sensitive operation on behalf of the impersonated identity.

ATT&CK Tactic

ATT&CK Technique

Severity

Medium

A cloud identity has impersonated another identity for the first time.

Check the identity's designation.
Verify that the identity did not perform any sensitive operation on behalf of the impersonated identity.

ATT&CK Tactic

ATT&CK Technique

Severity

Informational

A cloud identity has failed to impersonate another identity.

Check the identity's designation.
Verify that the identity did not perform any sensitive operation on behalf of the impersonated identity.