title Cloud Security layout tag author_profile false taxonomy Cloud Security permalink /stories/cloud_security/ sidebar nav stories Name Technique Tactic AWS Cross Account Activity Valid Accounts, Use Alternate Authentication Material Defense Evasion AWS IAM Privilege Escalation Cloud Accounts, Cloud Account, Cloud Infrastructure Discovery, Brute Force, Account Manipulation, Cloud Groups Defense Evasion AWS Network ACL Activity Disable or Modify Cloud Firewall Defense Evasion AWS Security Hub Alerts None None AWS User Monitoring Cloud Service Discovery Discovery Cloud Cryptomining Cloud Accounts, Unused/Unsupported Cloud Regions Defense Evasion Cloud Federated Credential Abuse Valid Accounts, LSASS Memory, Cloud Account, Modify Authentication Process, Image File Execution Options Injection Defense Evasion Container Implantation Monitoring and Investigation Implant Internal Image Persistence Dev Sec Ops Malicious Image, Compromise Client Software Binary, Compromise Software Dependencies and Development Tools, Exploitation for Credential Access, Cloud Service Discovery Execution GCP Cross Account Activity Valid Accounts Defense Evasion Kubernetes Scanning Activity Cloud Service Discovery Discovery Kubernetes Sensitive Object Access Activity None None Office 365 Detections Password Guessing, Cloud Account, Disable or Modify Cloud Firewall, Modify Authentication Process, Brute Force, Email Collection, Email Forwarding Rule, Remote Email Collection Credential Access Suspicious AWS Login Activities Unused/Unsupported Cloud Regions Defense Evasion Suspicious AWS S3 Activities Data from Cloud Storage Object Collection Suspicious AWS Traffic None None Suspicious Cloud Authentication Activities Unused/Unsupported Cloud Regions Defense Evasion Suspicious Cloud Instance Activities Cloud Accounts, Transfer Data to Cloud Account Defense Evasion Suspicious Cloud Provisioning Activities Valid Accounts Defense Evasion Suspicious Cloud User Activities Cloud Infrastructure Discovery, Cloud Accounts, Valid Accounts Discovery Suspicious GCP Storage Activities Data from Cloud Storage Object Collection