An AWS account attempted to leave the AWS Organization
이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다.Goal
Detect an AWS account attempting to leave an AWS organization.
Strategy
This rule allows you to monitor CloudTrail and detect if an attacker has attempted to have an AWS account leave an AWS organization using the LeaveOrganization API call.
An attacker may attempt this API call for several reasons, such as:
- Target security configurations that are often defined at the organization level. Leaving an organization can disrupt or disable these controls.
- Perform a denial of service (DoS) attack on the victim’s account that prevents the victim’s organization to access it.
Triage and response
- Determine if
{{@userIdentity.arn}} should have made the {{@evt.name}} API call. - If the API call was not made by the user:
- Rotate user credentials.
- Determine what other API calls were made by the user.
- Initiate your company’s incident response (IR) process.
- If the API call was made legitimately by the user:
- Communicate with the user to understand if this was a planned action.
- If No, see if other API calls were made by the user and determine if they warrant further investigation.
- Initiate your company’s incident response (IR) process.
