Classification:

attack

Tactic:

TA0004-privilege-escalation

Technique:

T1098-account-manipulation

VIEW RULE IN DATADOG VIEW SIGNALS

Set up the twilio integration.

Goal

Detect when an update was made to the Geographic Permissions in a Twilio account.

Strategy

This rule monitors when a change is made to the Geographic Permissions in an account. Attackers may leverage this for voice and messaging usage, leading to unexpectedly high costs.

Triage and response

1. Investigate if the change was expected.
2. Follow the guidelines provided by Twilio.