splunk-security_content/docs/_pages/cloud_security.md

title, layout, author_profile, taxonomy, permalink, sidebar

title	layout	author_profile	taxonomy	permalink	sidebar
Cloud Security	tag	false	Cloud Security	/stories/cloud_security/	nav stories

Name	Technique	Tactic
AWS Cross Account Activity	Valid Accounts, Use Alternate Authentication Material	Defense Evasion
AWS IAM Privilege Escalation	Cloud Accounts, Cloud Account, Cloud Infrastructure Discovery, Brute Force, Account Manipulation, Cloud Groups	Defense Evasion
AWS Network ACL Activity	Disable or Modify Cloud Firewall	Defense Evasion
AWS Security Hub Alerts	None	None
AWS User Monitoring	Cloud Service Discovery	Discovery
Cloud Cryptomining	Cloud Accounts, Unused/Unsupported Cloud Regions	Defense Evasion
Cloud Federated Credential Abuse	Valid Accounts, LSASS Memory, Cloud Account, Modify Authentication Process, Image File Execution Options Injection	Defense Evasion
Container Implantation Monitoring and Investigation	Implant Internal Image	Persistence
Dev Sec Ops	Malicious Image, Compromise Client Software Binary, Compromise Software Dependencies and Development Tools, Exploitation for Credential Access, Cloud Service Discovery	Execution
GCP Cross Account Activity	Valid Accounts	Defense Evasion
Kubernetes Scanning Activity	Cloud Service Discovery	Discovery
Kubernetes Sensitive Object Access Activity	None	None
Office 365 Detections	Password Guessing, Cloud Account, Disable or Modify Cloud Firewall, Modify Authentication Process, Brute Force, Email Collection, Email Forwarding Rule, Remote Email Collection	Credential Access
Suspicious AWS Login Activities	Unused/Unsupported Cloud Regions	Defense Evasion
Suspicious AWS S3 Activities	Data from Cloud Storage Object	Collection
Suspicious AWS Traffic	None	None
Suspicious Cloud Authentication Activities	Unused/Unsupported Cloud Regions	Defense Evasion
Suspicious Cloud Instance Activities	Cloud Accounts, Transfer Data to Cloud Account	Defense Evasion
Suspicious Cloud Provisioning Activities	Valid Accounts	Defense Evasion
Suspicious Cloud User Activities	Cloud Infrastructure Discovery, Cloud Accounts, Valid Accounts	Discovery
Suspicious GCP Storage Activities	Data from Cloud Storage Object	Collection