408 KiB
408 KiB
| 1 | TenantId | SourceSystem | MG | ManagementGroupName | TimeGenerated [UTC] | Computer | RawData | slot_ID_d | ID_g | availability_Value_d | performance_Value_d | measurement_Name_s | duration_d | warning_Threshold_d | critical_Threshold_d | IsActive_s | id_s | createdAt_t [UTC] | updatedAt_t [UTC] | entities_s | apps_s | Category | tactics_s | compliance_s | techniques_s | status_s | severity_s | policyId_s | policy_id_s | policy_name_s | policy_templateId_s | assigneeId_s | recommendation_s | description_s | isResolved_b | url_s | Type | _ResourceId |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:31.533 AM | 9a97cce292dca51fa5dccc5e171543048e287ccc | 3/7/2023, 11:39:40.845 PM | 5/2/2023, 12:41:51.339 AM | [ { "id": "9e4dc3efc5e619330aaf7c4196b52792ecc2ed8e", "name": "stacksets-exec-642a6aa5e9848f24ec83c92a24ae6711", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "IAM-10" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" } ] | [] | Open | High | 91723198479 | 91723198479 | AWS role with admin privileges | 88391696752 | Validate any new role creation and make sure it's part of the business cycle. If needed access the AWS console and remove the role. | AWS Admin Identity role stacksets-exec-642a6aa5e9848f24ec83c92a24ae6711 was created in AWS. | false | https://msftriskyuser.authomize.com/incidents/9a97cce292dca51fa5dccc5e171543048e287ccc | Authomize_v2_CL | |||||||||||||||
| 3 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:31.533 AM | 1426a7c7715210fb2682490b858c34b26ed91d27 | 3/7/2023, 11:39:40.837 PM | 5/2/2023, 12:41:51.338 AM | [ { "id": "b6259610c3717f183008360d1c5c44039c04249a", "name": "AuthomizeAdministrator", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "IAM-10" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" } ] | [] | Open | High | 91723198479 | 91723198479 | AWS role with admin privileges | 88391696752 | Validate any new role creation and make sure it's part of the business cycle. If needed access the AWS console and remove the role. | AWS Admin Identity role AuthomizeAdministrator was created in AWS. | false | https://msftriskyuser.authomize.com/incidents/1426a7c7715210fb2682490b858c34b26ed91d27 | Authomize_v2_CL | |||||||||||||||
| 4 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:31.533 AM | 6c0b7dfd3cf82a416d43d1062983f63082fbaa05 | 3/7/2023, 11:39:40.830 PM | 5/2/2023, 12:41:51.338 AM | [ { "id": "a8e80278f7e7dfd0625134b630d86173a5176edb", "name": "OrganizationAccountAccessRole", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "IAM-10" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" } ] | [] | Open | High | 91723198479 | 91723198479 | AWS role with admin privileges | 88391696752 | Validate any new role creation and make sure it's part of the business cycle. If needed access the AWS console and remove the role. | AWS Admin Identity role OrganizationAccountAccessRole was created in AWS. | false | https://msftriskyuser.authomize.com/incidents/6c0b7dfd3cf82a416d43d1062983f63082fbaa05 | Authomize_v2_CL | |||||||||||||||
| 5 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:31.533 AM | 73fdb933fecfebbba4f614907d63cb9f414ac821 | 3/7/2023, 11:39:40.823 PM | 5/2/2023, 12:41:51.338 AM | [ { "id": "619fcf487c5bd968da7fd2033381bc1643c83b5d", "name": "AuthomizeAdministrator", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "IAM-10" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" } ] | [] | Open | High | 91723198479 | 91723198479 | AWS role with admin privileges | 88391696752 | Validate any new role creation and make sure it's part of the business cycle. If needed access the AWS console and remove the role. | AWS Admin Identity role AuthomizeAdministrator was created in AWS. | false | https://msftriskyuser.authomize.com/incidents/73fdb933fecfebbba4f614907d63cb9f414ac821 | Authomize_v2_CL | |||||||||||||||
| 6 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:31.533 AM | 8d8f5905e05ca18097effce4694e97a2375d4241 | 3/7/2023, 11:39:33.344 PM | 5/2/2023, 12:41:24.539 AM | [ { "id": "22112528fefa67bd52c212cd9b0b531f95e87976", "name": "frontend_views", "object": "asset", "originId": null, "originType": "Instance" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "12.2", "13.4", "13.9", "13.10", "3.3" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IVS-03", "IVS-04" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "IVS-06", "AIS-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 91723197594 | 91723197594 | Privileged Machines Exposed to the Internet | 88391686020 | Validate that the resource exposed must remain so to fulfil its function. Validate the information this resource contains to prevent sensitive leaks of data. If the resource should not be accessible, block any of the networks rules from accepting public internet. Remember that a higher level resource might block other related resources from accessing the internet as well. It is possible to block a resource from the public internet by attaching a security group. | EC2 Instance frontend_views in AWS is exposed to the internet. The instance has the following role assigned: ec2_s3_full_access <br/> Full Exposure Path: <br/> | Resource | Type | | -------- |-------- | | prod_na-igw | Gateway | | customer-application-lb | LoadBalancer | | frontend_views | VirtualMachine | | false | https://msftriskyuser.authomize.com/incidents/8d8f5905e05ca18097effce4694e97a2375d4241 | Authomize_v2_CL | |||||||||||||||
| 7 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:31.533 AM | 77eeb95c34f203d00411561ddca3a0cb3de2786d | 3/6/2023, 11:41:16.717 PM | 5/2/2023, 12:41:59.132 AM | [ { "id": "03f798065de05f429ba76674a73869e8faf3a14b", "name": "storage-service-policy", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Least Privilege | [ "Collection", "Discovery", "Exfiltration", "Impact" ] | [] | [] | Open | High | 91723203704 | 91723203704 | Refactor AWS policy based on activities in the last 60 days. | 88391700422 | Update IAM policy storage-service-policy using the Authomize recommended new policy through the AWS console or other preffered methods. | The policy storage-service-policy in AWS account 291883359082 has excessive privileges that can be removed. Detection is based on activities during the last 60 days. | false | https://msftriskyuser.authomize.com/incidents/77eeb95c34f203d00411561ddca3a0cb3de2786d | Authomize_v2_CL | |||||||||||||||
| 8 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:31.533 AM | 2247ef0e15444516e7b15e8ffbfb42b7945d9e8d | 3/6/2023, 11:41:16.711 PM | 5/2/2023, 12:41:59.132 AM | [ { "id": "41de248e190f9a4d796059e9833732375fa63d9e", "name": "AmazonEKS_CNI_Policy-20220503081720914900000001", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Least Privilege | [ "Collection", "Discovery", "Exfiltration", "Impact" ] | [] | [] | Open | High | 91723203704 | 91723203704 | Refactor AWS policy based on activities in the last 60 days. | 88391700422 | Update IAM policy AmazonEKS_CNI_Policy-20220503081720914900000001 using the Authomize recommended new policy through the AWS console or other preffered methods. | The policy AmazonEKS_CNI_Policy-20220503081720914900000001 in AWS account 291883359082 has excessive privileges that can be removed. Detection is based on activities during the last 60 days. | false | https://msftriskyuser.authomize.com/incidents/2247ef0e15444516e7b15e8ffbfb42b7945d9e8d | Authomize_v2_CL | |||||||||||||||
| 9 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:31.533 AM | 0f2672a045bd1ae6b08986b4616579eddd36e98c | 3/6/2023, 11:41:16.705 PM | 5/2/2023, 12:41:59.132 AM | [ { "id": "9c7bb3c5f84fdb3235411e2ba66cd30853655665", "name": "AmazonEKS_EBS_CSI_Policy-20220510234308019800000002", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Least Privilege | [ "Collection", "Discovery", "Exfiltration", "Impact" ] | [] | [] | Open | High | 91723203704 | 91723203704 | Refactor AWS policy based on activities in the last 60 days. | 88391700422 | Update IAM policy AmazonEKS_EBS_CSI_Policy-20220510234308019800000002 using the Authomize recommended new policy through the AWS console or other preffered methods. | The policy AmazonEKS_EBS_CSI_Policy-20220510234308019800000002 in AWS account 291883359082 has excessive privileges that can be removed. Detection is based on activities during the last 60 days. | false | https://msftriskyuser.authomize.com/incidents/0f2672a045bd1ae6b08986b4616579eddd36e98c | Authomize_v2_CL | |||||||||||||||
| 10 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:31.533 AM | 727a2bfa2e5cfbf365ffc57d87b0b7a762c811bb | 3/6/2023, 11:40:39.657 PM | 5/2/2023, 12:41:21.559 AM | [ { "id": "bb786de8906e3dfad445d7d07466796ebb50eb1b", "name": "privesc15-PassExistingRoleToNewLambdaThenInvoke", "object": "asset", "originId": null, "originType": "PolicyResource" }, { "id": "af3fcb9bc7cf55a9e94e1e6000a2ad56e76c5984", "name": "privesc15-PassExistingRoleToNewLambdaThenInvoke-role", "object": "identity", "email": null }, { "id": "f50d5abbb3ab5d07ea0fb91a38f5480808240c00", "name": "privesc15-PassExistingRoleToNewLambdaThenInvoke-role", "object": "account", "originId": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Least Privilege | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723196731 | 91723196731 | Stale IAAS policy attachment to role | 88391681312 | Unused policies should be detached from privesc15-PassExistingRoleToNewLambdaThenInvoke-role | privesc15-PassExistingRoleToNewLambdaThenInvoke-role hasn't used the Policy privesc15-PassExistingRoleToNewLambdaThenInvoke during the past 30 days. | false | https://msftriskyuser.authomize.com/incidents/727a2bfa2e5cfbf365ffc57d87b0b7a762c811bb | Authomize_v2_CL | |||||||||||||||
| 11 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:31.533 AM | 3bf6bd0b9b8df0b9d77aa60a8d4bc693251b903b | 3/6/2023, 11:40:39.651 PM | 5/2/2023, 12:41:21.559 AM | [ { "id": "289913f8294a9a91eea3c09925c324e2634c6e04", "name": "privesc1-CreateNewPolicyVersion", "object": "asset", "originId": null, "originType": "PolicyResource" }, { "id": "f7a97b83c333f46af3b8b0ae91edc1de7ec96f7e", "name": "privesc1-CreateNewPolicyVersion-role", "object": "identity", "email": null }, { "id": "b494fd2e5c32528f6f7868d28ce0bddb813efdc7", "name": "privesc1-CreateNewPolicyVersion-role", "object": "account", "originId": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Least Privilege | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723196731 | 91723196731 | Stale IAAS policy attachment to role | 88391681312 | Unused policies should be detached from privesc1-CreateNewPolicyVersion-role | privesc1-CreateNewPolicyVersion-role hasn't used the Policy privesc1-CreateNewPolicyVersion during the past 30 days. | false | https://msftriskyuser.authomize.com/incidents/3bf6bd0b9b8df0b9d77aa60a8d4bc693251b903b | Authomize_v2_CL | |||||||||||||||
| 12 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:26.361 AM | c487290642375789a5df8a3d4fbabe664b60d404 | 3/10/2023, 11:37:05.723 AM | 5/2/2023, 12:33:06.159 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "04cc89d889cbc797eb94d65587b40f98981fb06e", "name": "role/allow-ec2-connection-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/allow-ec2-connection-role:trustpolicy on AWS. Access was gained through allow-ec2-connection-role | false | https://msftriskyuser.authomize.com/incidents/c487290642375789a5df8a3d4fbabe664b60d404 | Authomize_v2_CL | |||||||||||||||
| 13 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:26.361 AM | cea1186d41e84dea93f7f2a003a10abaad77f02f | 3/10/2023, 11:37:05.717 AM | 5/2/2023, 12:33:06.162 AM | [ { "id": "04d5be4fda16548fdc0b0c7a20701cc4a108a769", "name": "AuthomizeCustomerRoleAssumer", "object": "identity", "email": null }, { "id": "bdf06bbed962f1bf92a92d1419664c3632656ab5", "name": "AuthomizeLocalRole", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | AuthomizeCustomerRoleAssumer gained access to Resource_EntitlementProxy AuthomizeLocalRole on AWS. | false | https://msftriskyuser.authomize.com/incidents/cea1186d41e84dea93f7f2a003a10abaad77f02f | Authomize_v2_CL | |||||||||||||||
| 14 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:26.361 AM | eed14883d2ace1675c54430b99c563479854b049 | 3/10/2023, 11:37:05.710 AM | 5/2/2023, 12:33:06.161 AM | [ { "id": "04d5be4fda16548fdc0b0c7a20701cc4a108a769", "name": "AuthomizeCustomerRoleAssumer", "object": "identity", "email": null }, { "id": "05d18c21b10725df5f8de9008aaa974efa5a41b8", "name": "role/authomizelocalrole:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | AuthomizeCustomerRoleAssumer gained access to Policy role/authomizelocalrole:trustpolicy on AWS. Access was gained through AuthomizeLocalRole | false | https://msftriskyuser.authomize.com/incidents/eed14883d2ace1675c54430b99c563479854b049 | Authomize_v2_CL | |||||||||||||||
| 15 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:26.361 AM | b6b9e32e4a4f5116e8ae9a9b0f2545db37c5d5f6 | 3/9/2023, 11:37:10.061 PM | 5/2/2023, 12:37:26.310 AM | [ { "id": "b31468ef8439325f547f1ba60f59702a87e04b90", "name": "AWSAuditAccountAdmins", "object": "identity", "email": null }, { "id": "89e09c06da0cdd5f0ff36b3fdf56419f07943824", "name": "AWSAuditAccountAdmins", "object": "account", "originId": null } ] | [ { "id": "35a7fa81a6ad1067e8e7225fa82c8e25aa8782e7", "name": "AWS IAM Identity Center" } ] | Change Management | [ "Defense Evasion", "Lateral Movement", "Persistence", "Privilege Escalation" ] | [ { "values": [ "6.2", "5.3" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "CC6.2", "CC6.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" } ] | [ "Account Manipulation", "Valid Accounts" ] | Open | Medium | 74705343919 | 74705343919 | Empty group with entitlements | 74701857016 | It is advisable to remove this group. | The group AWSAuditAccountAdmins has no members but is entitled to one or more assets. | false | https://msftriskyuser.authomize.com/incidents/b6b9e32e4a4f5116e8ae9a9b0f2545db37c5d5f6 | Authomize_v2_CL | |||||||||||||||
| 16 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:26.361 AM | e281f539092722c226a543ca5218b8f71f7d1744 | 3/9/2023, 11:37:10.056 PM | 5/2/2023, 12:37:26.311 AM | [ { "id": "7bf906277b6d511b9a8ad5b204fd3fe0697a0653", "name": "AWSSecurityAuditors", "object": "identity", "email": null }, { "id": "8759c05a5b536120070be0d67b9e5e34f9b01b1a", "name": "AWSSecurityAuditors", "object": "account", "originId": null } ] | [ { "id": "35a7fa81a6ad1067e8e7225fa82c8e25aa8782e7", "name": "AWS IAM Identity Center" } ] | Change Management | [ "Defense Evasion", "Lateral Movement", "Persistence", "Privilege Escalation" ] | [ { "values": [ "6.2", "5.3" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "CC6.2", "CC6.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" } ] | [ "Account Manipulation", "Valid Accounts" ] | Open | Medium | 74705343919 | 74705343919 | Empty group with entitlements | 74701857016 | It is advisable to remove this group. | The group AWSSecurityAuditors has no members but is entitled to one or more assets. | false | https://msftriskyuser.authomize.com/incidents/e281f539092722c226a543ca5218b8f71f7d1744 | Authomize_v2_CL | |||||||||||||||
| 17 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:26.361 AM | 88c0d50f0162b06762296ce4b4dd9215115cb2af | 3/9/2023, 11:37:10.051 PM | 5/2/2023, 12:37:26.309 AM | [ { "id": "9d986c78d42b834dca44b0837f14857177c96a05", "name": "AWSServiceCatalogAdmins", "object": "identity", "email": null }, { "id": "89d06a61b06b5cb4dd691c85087184b744d2b5dc", "name": "AWSServiceCatalogAdmins", "object": "account", "originId": null } ] | [ { "id": "35a7fa81a6ad1067e8e7225fa82c8e25aa8782e7", "name": "AWS IAM Identity Center" } ] | Change Management | [ "Defense Evasion", "Lateral Movement", "Persistence", "Privilege Escalation" ] | [ { "values": [ "6.2", "5.3" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "CC6.2", "CC6.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" } ] | [ "Account Manipulation", "Valid Accounts" ] | Open | Medium | 74705343919 | 74705343919 | Empty group with entitlements | 74701857016 | It is advisable to remove this group. | The group AWSServiceCatalogAdmins has no members but is entitled to one or more assets. | false | https://msftriskyuser.authomize.com/incidents/88c0d50f0162b06762296ce4b4dd9215115cb2af | Authomize_v2_CL | |||||||||||||||
| 18 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:26.361 AM | 3b0a6fe6d09345067098d281ba4d5099fa096ee3 | 3/9/2023, 11:37:10.047 PM | 5/2/2023, 12:37:26.309 AM | [ { "id": "b593a5046988c58020ee3a5ce7bd436d126d5c9c", "name": "AWSLogArchiveViewers", "object": "identity", "email": null }, { "id": "932fcbbc44a59748bafc5f667ce96e838f112290", "name": "AWSLogArchiveViewers", "object": "account", "originId": null } ] | [ { "id": "35a7fa81a6ad1067e8e7225fa82c8e25aa8782e7", "name": "AWS IAM Identity Center" } ] | Change Management | [ "Defense Evasion", "Lateral Movement", "Persistence", "Privilege Escalation" ] | [ { "values": [ "6.2", "5.3" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "CC6.2", "CC6.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" } ] | [ "Account Manipulation", "Valid Accounts" ] | Open | Medium | 74705343919 | 74705343919 | Empty group with entitlements | 74701857016 | It is advisable to remove this group. | The group AWSLogArchiveViewers has no members but is entitled to one or more assets. | false | https://msftriskyuser.authomize.com/incidents/3b0a6fe6d09345067098d281ba4d5099fa096ee3 | Authomize_v2_CL | |||||||||||||||
| 19 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:26.361 AM | 5c5611e49cb1f2e5ebc2f054161a0ae26e822e31 | 3/9/2023, 11:37:10.042 PM | 5/2/2023, 12:37:26.311 AM | [ { "id": "1734f2bc90fbd7cfd4edc29ee9318777672f84f8", "name": "test_group", "object": "identity", "email": null }, { "id": "41e01e5835760fb42eb4c9838acfcc7e1e23ab3d", "name": "test_group", "object": "account", "originId": null } ] | [ { "id": "35a7fa81a6ad1067e8e7225fa82c8e25aa8782e7", "name": "AWS IAM Identity Center" } ] | Change Management | [ "Defense Evasion", "Lateral Movement", "Persistence", "Privilege Escalation" ] | [ { "values": [ "6.2", "5.3" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "CC6.2", "CC6.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" } ] | [ "Account Manipulation", "Valid Accounts" ] | Open | Medium | 74705343919 | 74705343919 | Empty group with entitlements | 74701857016 | It is advisable to remove this group. | The group test_group has no members but is entitled to one or more assets. | false | https://msftriskyuser.authomize.com/incidents/5c5611e49cb1f2e5ebc2f054161a0ae26e822e31 | Authomize_v2_CL | |||||||||||||||
| 20 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:26.361 AM | 556113dce2a1a71b3afd75f510f32746f078870d | 3/9/2023, 11:37:10.037 PM | 5/2/2023, 12:37:26.309 AM | [ { "id": "cb62f23d1475f052aeaf29fb43a06ef91e6403a8", "name": "AWSSecurityAuditPowerUsers", "object": "identity", "email": null }, { "id": "d45a169b805faf4c3d259831265a8f00d25abc29", "name": "AWSSecurityAuditPowerUsers", "object": "account", "originId": null } ] | [ { "id": "35a7fa81a6ad1067e8e7225fa82c8e25aa8782e7", "name": "AWS IAM Identity Center" } ] | Change Management | [ "Defense Evasion", "Lateral Movement", "Persistence", "Privilege Escalation" ] | [ { "values": [ "6.2", "5.3" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "CC6.2", "CC6.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" } ] | [ "Account Manipulation", "Valid Accounts" ] | Open | Medium | 74705343919 | 74705343919 | Empty group with entitlements | 74701857016 | It is advisable to remove this group. | The group AWSSecurityAuditPowerUsers has no members but is entitled to one or more assets. | false | https://msftriskyuser.authomize.com/incidents/556113dce2a1a71b3afd75f510f32746f078870d | Authomize_v2_CL | |||||||||||||||
| 21 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:26.361 AM | f3636a06ff83731756d71651f14b7ab042606106 | 3/9/2023, 11:37:10.032 PM | 5/2/2023, 12:37:26.308 AM | [ { "id": "28e2c566379447d14c7d2ca6eb64dab1f4a47f3d", "name": "AWSLogArchiveAdmins", "object": "identity", "email": null }, { "id": "48e55ab62e6815ebbb91eddfdb54c5ca5784fec9", "name": "AWSLogArchiveAdmins", "object": "account", "originId": null } ] | [ { "id": "35a7fa81a6ad1067e8e7225fa82c8e25aa8782e7", "name": "AWS IAM Identity Center" } ] | Change Management | [ "Defense Evasion", "Lateral Movement", "Persistence", "Privilege Escalation" ] | [ { "values": [ "6.2", "5.3" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "CC6.2", "CC6.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" } ] | [ "Account Manipulation", "Valid Accounts" ] | Open | Medium | 74705343919 | 74705343919 | Empty group with entitlements | 74701857016 | It is advisable to remove this group. | The group AWSLogArchiveAdmins has no members but is entitled to one or more assets. | false | https://msftriskyuser.authomize.com/incidents/f3636a06ff83731756d71651f14b7ab042606106 | Authomize_v2_CL | |||||||||||||||
| 22 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:42.170 AM | 58691a287dc0e76ef5b6357abd025dbf25876001 | 3/6/2023, 11:40:18.941 PM | 5/2/2023, 12:41:13.705 AM | [ { "id": "cba1878c0d07a5530b835a9198cd67dd3ab99502", "name": "AuthomizeMasterAccountUser", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [] | [ { "values": [ "5.1", "3.1" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-03" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.1", "A.8.1.1" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC3.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-10" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 91723190746 | 91723190746 | Detect AWS IAM Users | 88391685076 | Make sure this IAM account is necessary If this account is temporary, remember to deactivate or remove it once not required anymore. | IAM user AuthomizeMasterAccountUser was detected in AWS. | false | https://msftriskyuser.authomize.com/incidents/58691a287dc0e76ef5b6357abd025dbf25876001 | Authomize_v2_CL | |||||||||||||||
| 23 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:42.170 AM | ea3dd9ff719dbfafc0bbab28fd9d890e1134e12c | 3/6/2023, 11:37:11.549 PM | 5/2/2023, 12:33:58.913 AM | [ { "id": "bf2be9d8713021d095f0f043f73a9234ca5ed1cc", "name": "manage-policies", "object": "identity", "email": null }, { "id": "289913f8294a9a91eea3c09925c324e2634c6e04", "name": "privesc1-CreateNewPolicyVersion", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [ "Initial Access", "Credential Access", "Privilege Escalation" ] | [ { "values": [ "5.1" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-03" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.8.1.1", "A.9.4.1" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-10" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [ "Trusted Relationship", "Steal Application Access Token", "Valid Accounts" ] | Open | High | 74705329316 | 74705329316 | IaaS shadow admin detected | 74701855785 | Shadow admins have sensitive privileges and can perform risky actions, review the accounts. Make sure any privileged IaaS entity follows the least privileged principle. | manage-policies has been granted shadow-admin privileges in AWS. The privileges were granted via the access policy <strong>privesc1-CreateNewPolicyVersion</strong> of type Policy directly.<br/> By assigning manage-policies to the privesc1-CreateNewPolicyVersion access policy, they have gained the following privileges: iam:createpolicyversion. | false | https://msftriskyuser.authomize.com/incidents/ea3dd9ff719dbfafc0bbab28fd9d890e1134e12c | Authomize_v2_CL | |||||||||||||||
| 24 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:42.170 AM | 536a3f646f56a67dcb154919979ac74393316d62 | 3/6/2023, 11:36:57.503 PM | 5/2/2023, 12:35:06.715 AM | [ { "id": "b21f017e7fdd4b5079fd2d43dd37ef34b6b8c48b", "name": "kim rice@acme com", "object": "identity", "email": null }, { "id": "04c8b99fc389ce9a429a970f5adb9df182199431", "name": "iam_admin", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [ "Initial Access", "Credential Access" ] | [ { "values": [ "5.1" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-03" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.8.1.1", "A.9.4.1" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-10" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [ "Trusted Relationship", "Steal Application Access Token" ] | Open | High | 74705326643 | 74705326643 | IaaS admin detected | 74701855663 | Validate any new admins. Make sure any new admins follows the least privileged principle. | kim rice@acme com has been granted admin privileges in AWS. The privileges were granted via the access policy <strong>iam_admin</strong> of type Policy directly.<br/> By assigning kim rice@acme com to the iam_admin access policy, they have gained the following privileges: iam:*. | false | https://msftriskyuser.authomize.com/incidents/536a3f646f56a67dcb154919979ac74393316d62 | Authomize_v2_CL | |||||||||||||||
| 25 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:42.170 AM | b77095dfa5709257057a0398ed13d0d81d04cb57 | 3/6/2023, 11:36:57.492 PM | 5/2/2023, 12:35:06.714 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "1371445936f25baa04e2f6c728bf7caf311d5ed2", "name": "AdministratorAccess", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [ "Initial Access", "Credential Access" ] | [ { "values": [ "5.1" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-03" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.8.1.1", "A.9.4.1" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-10" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [ "Trusted Relationship", "Steal Application Access Token" ] | Open | High | 74705326643 | 74705326643 | IaaS admin detected | 74701855663 | Validate any new admins. Make sure any new admins follows the least privileged principle. | cli user has been granted admin privileges in AWS. The privileges were granted via the access policy <strong>AdministratorAccess</strong> of type Policy directly.<br/> By assigning cli user to the AdministratorAccess access policy, they have gained the following privileges: *:*. | false | https://msftriskyuser.authomize.com/incidents/b77095dfa5709257057a0398ed13d0d81d04cb57 | Authomize_v2_CL | |||||||||||||||
| 26 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:42.170 AM | edc84764dd9f5c3066cdba0d9b355258c1766529 | 3/6/2023, 11:36:57.481 PM | 5/2/2023, 12:35:06.714 AM | [ { "id": "6147e2cb17bb389c1d97e274e0e844d1a30f3763", "name": "rnd-management", "object": "identity", "email": null }, { "id": "844a59bcacd070e3e47759024aca96b5d6f05353", "name": "site-reliability-engineering", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [ "Initial Access", "Credential Access" ] | [ { "values": [ "5.1" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-03" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.8.1.1", "A.9.4.1" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-10" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [ "Trusted Relationship", "Steal Application Access Token" ] | Open | High | 74705326643 | 74705326643 | IaaS admin detected | 74701855663 | Validate any new admins. Make sure any new admins follows the least privileged principle. | rnd-management has been granted admin privileges in AWS. The privileges were granted via the access policy <strong>site-reliability-engineering</strong> of type Policy via the group privesc-sre-group.<br/> By assigning rnd-management to the site-reliability-engineering access policy, they have gained the following privileges: iam:*. | false | https://msftriskyuser.authomize.com/incidents/edc84764dd9f5c3066cdba0d9b355258c1766529 | Authomize_v2_CL | |||||||||||||||
| 27 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:42.170 AM | ff6c9dd447bb13860de357bc3ed2c4e60387291b | 3/6/2023, 11:36:57.461 PM | 5/2/2023, 12:35:06.714 AM | [ { "id": "0dc77cd79ca8e4a97c12db8241463a9615d8f7f6", "name": "devop-admin", "object": "identity", "email": null }, { "id": "c7a0ad09d8e61ea968d3562c459965a4f147adef", "name": "admin-priv", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [ "Initial Access", "Credential Access" ] | [ { "values": [ "5.1" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-03" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.8.1.1", "A.9.4.1" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-10" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [ "Trusted Relationship", "Steal Application Access Token" ] | Open | High | 74705326643 | 74705326643 | IaaS admin detected | 74701855663 | Validate any new admins. Make sure any new admins follows the least privileged principle. | devop-admin has been granted admin privileges in AWS. The privileges were granted via the access policy <strong>admin-priv</strong> of type Policy directly.<br/> By assigning devop-admin to the admin-priv access policy, they have gained the following privileges: *:*. | false | https://msftriskyuser.authomize.com/incidents/ff6c9dd447bb13860de357bc3ed2c4e60387291b | Authomize_v2_CL | |||||||||||||||
| 28 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:42.170 AM | 2b23860827c9a408068a0ebac58c42bbd6181d59 | 3/6/2023, 11:36:42.395 PM | 5/2/2023, 12:34:25.596 AM | [ { "id": "2cee0622e84e4f94a1f24fc77499544568f77d30", "name": "lambda-func-support", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2", "A.9.2.2", "A.9.4.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-05", "IAM-02" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 74705321436 | 74705321436 | Access to AWS without MFA | 74701855853 | Require MFA for all IAM users Require MFA for all users in your IdP. If that is not possible, make sure that those with access to IaaS environments have MFA enabled. | lambda-func-support's AWS account does not have MFA enabled | false | https://msftriskyuser.authomize.com/incidents/2b23860827c9a408068a0ebac58c42bbd6181d59 | Authomize_v2_CL | |||||||||||||||
| 29 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:42.170 AM | a8dfe3c0cc3fd400bb1c3eea6ad130226b5445bd | 3/6/2023, 11:36:42.383 PM | 5/2/2023, 12:34:25.593 AM | [ { "id": "362210a1b7ac1cb5264d9cb2cb83ff387f541d74", "name": "Root user", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2", "A.9.2.2", "A.9.4.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-05", "IAM-02" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 74705321436 | 74705321436 | Access to AWS without MFA | 74701855853 | Require MFA for all IAM users Require MFA for all users in your IdP. If that is not possible, make sure that those with access to IaaS environments have MFA enabled. | Root user's AWS account does not have MFA enabled | false | https://msftriskyuser.authomize.com/incidents/a8dfe3c0cc3fd400bb1c3eea6ad130226b5445bd | Authomize_v2_CL | |||||||||||||||
| 30 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:42.170 AM | bc2052ab4b0ebf99bb193502d59defd3b5902fee | 3/6/2023, 11:36:42.368 PM | 5/2/2023, 12:34:25.594 AM | [ { "id": "bf2be9d8713021d095f0f043f73a9234ca5ed1cc", "name": "manage-policies", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2", "A.9.2.2", "A.9.4.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-05", "IAM-02" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 74705321436 | 74705321436 | Access to AWS without MFA | 74701855853 | Require MFA for all IAM users Require MFA for all users in your IdP. If that is not possible, make sure that those with access to IaaS environments have MFA enabled. | manage-policies's AWS account does not have MFA enabled | false | https://msftriskyuser.authomize.com/incidents/bc2052ab4b0ebf99bb193502d59defd3b5902fee | Authomize_v2_CL | |||||||||||||||
| 31 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:42.170 AM | ad986aa44e7be41c7e71f00b3d2d16a9bdb7dbb2 | 3/6/2023, 11:36:42.357 PM | 5/2/2023, 12:34:25.594 AM | [ { "id": "b21f017e7fdd4b5079fd2d43dd37ef34b6b8c48b", "name": "kim rice@acme com", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2", "A.9.2.2", "A.9.4.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-05", "IAM-02" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 74705321436 | 74705321436 | Access to AWS without MFA | 74701855853 | Require MFA for all IAM users Require MFA for all users in your IdP. If that is not possible, make sure that those with access to IaaS environments have MFA enabled. | kim rice@acme com's AWS account does not have MFA enabled | false | https://msftriskyuser.authomize.com/incidents/ad986aa44e7be41c7e71f00b3d2d16a9bdb7dbb2 | Authomize_v2_CL | |||||||||||||||
| 32 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:12.377 AM | a5ce593ce7564b4750d6dbb4c8cb02ce3e806d75 | 4/27/2023, 3:03:12.058 AM | 5/2/2023, 12:41:21.560 AM | [ { "id": "9c7bb3c5f84fdb3235411e2ba66cd30853655665", "name": "AmazonEKS_EBS_CSI_Policy-20220510234308019800000002", "object": "asset", "originId": null, "originType": "PolicyResource" }, { "id": "9c99335efc340fcc9b4825ebc7ce25b40806478e", "name": "ebs-csi20220510234308018400000001", "object": "identity", "email": null }, { "id": "823dc1c5ace371b8435718494e1e11533979b15b", "name": "ebs-csi20220510234308018400000001", "object": "account", "originId": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723196731 | 91723196731 | Stale IAAS policy attachment to role | 88391681312 | Unused policies should be detached from ebs-csi20220510234308018400000001 | ebs-csi20220510234308018400000001 hasn't used the Policy AmazonEKS_EBS_CSI_Policy-20220510234308019800000002 during the past 30 days. | false | https://msftriskyuser.authomize.com/incidents/a5ce593ce7564b4750d6dbb4c8cb02ce3e806d75 | Authomize_v2_CL | ||||||||||||||||
| 33 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:12.377 AM | 4004c78d2b6c44f32ef6917186972c9d703f3299 | 4/27/2023, 3:03:04.569 AM | 5/2/2023, 12:41:18.458 AM | [ { "id": "9c7bb3c5f84fdb3235411e2ba66cd30853655665", "name": "AmazonEKS_EBS_CSI_Policy-20220510234308019800000002", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 91723195066 | 91723195066 | Unused IaaS Policy | 88391682078 | Go to AWS console, access account 291883359082, or the way you manage user assignment to rolesRemove the policy AmazonEKS_EBS_CSI_Policy-20220510234308019800000002 completely or remove if from any identity that has access to it (the list can be found in our identity page) | The policy AmazonEKS_EBS_CSI_Policy-20220510234308019800000002 haven't been used during the last 30 days in account 291883359082, the policy is attached to 1 identities | false | https://msftriskyuser.authomize.com/incidents/4004c78d2b6c44f32ef6917186972c9d703f3299 | Authomize_v2_CL | ||||||||||||||||
| 34 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:12.377 AM | 105084770081 | 4/26/2023, 12:06:31.027 PM | 5/2/2023, 12:41:59.174 AM | [ { "id": "db72c19c40a4c44a25d56824e4490b2e40a71f7d", "name": "empty_role_allow_assume", "object": "identity", "email": null }, { "id": "319d63d56065543badcc8a611ec8c435caa373b0", "name": "Okta__ec2_lambda_s3_full", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Least Privilege | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "IAM-10" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" } ] | [] | Open | High | 91723202628 | 91723202628 | Chain of 3 or more roles | 88391698510 | Check with the account manager if there is an need for this role assuming access. If it is not needed, update the trust policy. If an operational need exists, break the chain and assign the role directly for increased security. | false | https://msftriskyuser.authomize.com/incidents/105084770081 | Authomize_v2_CL | ||||||||||||||||
| 35 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:12.377 AM | 2915922100d3d480e1dd8d95bcb2492af2017d6c | 4/23/2023, 12:03:44.946 PM | 5/2/2023, 12:41:53.859 AM | [ { "id": "d37b4b59e47d71f6f11326b45bc848791c6f75bc", "name": "Root user", "object": "identity", "email": null }, { "id": "b8e0bbe3f7f97a34821108a6b1d2f2cba6ad5607", "name": "OrganizationAccountAccessRole", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723201792 | 91723201792 | Unused federated access to a specific AWS role | 88391698088 | Revoke all unused access to your infrastructure. Grant access to IaaS resources on a must have basis. Revoke the user's ability to assume the role in AWS. | Root user has not assumed the role OrganizationAccountAccessRole in AWS account 291883359082 during the last 60 days. | false | https://msftriskyuser.authomize.com/incidents/2915922100d3d480e1dd8d95bcb2492af2017d6c | Authomize_v2_CL | ||||||||||||||||
| 36 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:12.377 AM | c6bb0e6e0a9d8c7456c9f8bfc3976fb6a77c620c | 4/23/2023, 12:03:44.940 PM | 5/2/2023, 12:41:53.860 AM | [ { "id": "d37b4b59e47d71f6f11326b45bc848791c6f75bc", "name": "Root user", "object": "identity", "email": null }, { "id": "a80fdf41855aaa5aaf374a5c816f3fc33357a600", "name": "AWSControlTowerExecution", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723201792 | 91723201792 | Unused federated access to a specific AWS role | 88391698088 | Revoke all unused access to your infrastructure. Grant access to IaaS resources on a must have basis. Revoke the user's ability to assume the role in AWS. | Root user has not assumed the role AWSControlTowerExecution in AWS account 291883359082 during the last 60 days. | false | https://msftriskyuser.authomize.com/incidents/c6bb0e6e0a9d8c7456c9f8bfc3976fb6a77c620c | Authomize_v2_CL | ||||||||||||||||
| 37 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:12.377 AM | b1bf34e56642cd649d2dc0b762560df03f998d45 | 4/23/2023, 12:03:44.935 PM | 5/2/2023, 12:41:53.860 AM | [ { "id": "d37b4b59e47d71f6f11326b45bc848791c6f75bc", "name": "Root user", "object": "identity", "email": null }, { "id": "a8e80278f7e7dfd0625134b630d86173a5176edb", "name": "OrganizationAccountAccessRole", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723201792 | 91723201792 | Unused federated access to a specific AWS role | 88391698088 | Revoke all unused access to your infrastructure. Grant access to IaaS resources on a must have basis. Revoke the user's ability to assume the role in AWS. | Root user has not assumed the role OrganizationAccountAccessRole in AWS account 071186405907 during the last 60 days. | false | https://msftriskyuser.authomize.com/incidents/b1bf34e56642cd649d2dc0b762560df03f998d45 | Authomize_v2_CL | ||||||||||||||||
| 38 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:12.377 AM | a92832a8e14e2b2bc269464364a45ddce7229006 | 4/23/2023, 12:03:44.930 PM | 5/2/2023, 12:41:53.860 AM | [ { "id": "04d5be4fda16548fdc0b0c7a20701cc4a108a769", "name": "AuthomizeCustomerRoleAssumer", "object": "identity", "email": null }, { "id": "63abe4095886e94aad8ceb1beb1c9a7d52f144cd", "name": "AuthomizeLocalRole", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723201792 | 91723201792 | Unused federated access to a specific AWS role | 88391698088 | Revoke all unused access to your infrastructure. Grant access to IaaS resources on a must have basis. Revoke the user's ability to assume the role in AWS. | AuthomizeCustomerRoleAssumer has not assumed the role AuthomizeLocalRole in AWS account 071186405907 during the last 60 days. | false | https://msftriskyuser.authomize.com/incidents/a92832a8e14e2b2bc269464364a45ddce7229006 | Authomize_v2_CL | ||||||||||||||||
| 39 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:12.377 AM | 16d35a816d3c38d9d106f1bfe47ab56fa0208c68 | 4/23/2023, 12:03:44.925 PM | 5/2/2023, 12:41:53.860 AM | [ { "id": "04d5be4fda16548fdc0b0c7a20701cc4a108a769", "name": "AuthomizeCustomerRoleAssumer", "object": "identity", "email": null }, { "id": "18132c0ae670087a4aa444eede8c14c6c7e84fcc", "name": "AuthomizeLocalRole", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723201792 | 91723201792 | Unused federated access to a specific AWS role | 88391698088 | Revoke all unused access to your infrastructure. Grant access to IaaS resources on a must have basis. Revoke the user's ability to assume the role in AWS. | AuthomizeCustomerRoleAssumer has not assumed the role AuthomizeLocalRole in AWS account 234690524301 during the last 60 days. | false | https://msftriskyuser.authomize.com/incidents/16d35a816d3c38d9d106f1bfe47ab56fa0208c68 | Authomize_v2_CL | ||||||||||||||||
| 40 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:12.377 AM | ecc6f72af4854301dbaaf10e3fe941d537e88f28 | 4/23/2023, 12:03:44.919 PM | 5/2/2023, 12:41:53.860 AM | [ { "id": "04d5be4fda16548fdc0b0c7a20701cc4a108a769", "name": "AuthomizeCustomerRoleAssumer", "object": "identity", "email": null }, { "id": "0464102564b78461f4d2d5acdab0bca37a9920dc", "name": "AuthomizeCrossAccountTrustRole", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723201792 | 91723201792 | Unused federated access to a specific AWS role | 88391698088 | Revoke all unused access to your infrastructure. Grant access to IaaS resources on a must have basis. Revoke the user's ability to assume the role in AWS. | AuthomizeCustomerRoleAssumer has not assumed the role AuthomizeCrossAccountTrustRole in AWS account 234690524301 during the last 60 days. | false | https://msftriskyuser.authomize.com/incidents/ecc6f72af4854301dbaaf10e3fe941d537e88f28 | Authomize_v2_CL | ||||||||||||||||
| 41 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:12.377 AM | 16f845466d0ec27868a933bf408d703fd43b01a9 | 4/11/2023, 11:39:38.548 PM | 5/2/2023, 12:34:17.129 AM | [ { "id": "2cee0622e84e4f94a1f24fc77499544568f77d30", "name": "lambda-func-support", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | [] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2", "A.9.2.2", "A.9.4.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-05", "IAM-02" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 101379015902 | 101379015902 | Access to IaaS without MFA | 98691894310 | Require MFA for all IAM users Require MFA for all users in your IdP. If that is not possible, make sure that those with access to IaaS environments have MFA enabled. | lambda-func-support's AWS account does not have MFA enabled | false | https://msftriskyuser.authomize.com/incidents/16f845466d0ec27868a933bf408d703fd43b01a9 | Authomize_v2_CL | ||||||||||||||||
| 42 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:13.488 AM | 0ce0c9ac3b2f1a58f303e62ef98da8edb194d927 | 4/11/2023, 11:39:38.538 PM | 5/2/2023, 12:34:17.128 AM | [ { "id": "362210a1b7ac1cb5264d9cb2cb83ff387f541d74", "name": "Root user", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | [] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2", "A.9.2.2", "A.9.4.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-05", "IAM-02" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 101379015902 | 101379015902 | Access to IaaS without MFA | 98691894310 | Require MFA for all IAM users Require MFA for all users in your IdP. If that is not possible, make sure that those with access to IaaS environments have MFA enabled. | Root user's AWS account does not have MFA enabled | false | https://msftriskyuser.authomize.com/incidents/0ce0c9ac3b2f1a58f303e62ef98da8edb194d927 | Authomize_v2_CL | ||||||||||||||||
| 43 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:13.488 AM | 2feadbe901a9f8a0bc579e9816af5e369e7d2d1e | 4/11/2023, 11:39:38.529 PM | 5/2/2023, 12:34:17.128 AM | [ { "id": "bf2be9d8713021d095f0f043f73a9234ca5ed1cc", "name": "manage-policies", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | [] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2", "A.9.2.2", "A.9.4.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-05", "IAM-02" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 101379015902 | 101379015902 | Access to IaaS without MFA | 98691894310 | Require MFA for all IAM users Require MFA for all users in your IdP. If that is not possible, make sure that those with access to IaaS environments have MFA enabled. | manage-policies's AWS account does not have MFA enabled | false | https://msftriskyuser.authomize.com/incidents/2feadbe901a9f8a0bc579e9816af5e369e7d2d1e | Authomize_v2_CL | ||||||||||||||||
| 44 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:13.488 AM | 09ab0bfbad6d191b942c1b8f19aa4ef6349453a3 | 4/11/2023, 11:39:38.522 PM | 5/2/2023, 12:34:17.128 AM | [ { "id": "b21f017e7fdd4b5079fd2d43dd37ef34b6b8c48b", "name": "kim rice@acme com", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | [] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2", "A.9.2.2", "A.9.4.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-05", "IAM-02" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 101379015902 | 101379015902 | Access to IaaS without MFA | 98691894310 | Require MFA for all IAM users Require MFA for all users in your IdP. If that is not possible, make sure that those with access to IaaS environments have MFA enabled. | kim rice@acme com's AWS account does not have MFA enabled | false | https://msftriskyuser.authomize.com/incidents/09ab0bfbad6d191b942c1b8f19aa4ef6349453a3 | Authomize_v2_CL | ||||||||||||||||
| 45 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:13.488 AM | 3860b36bf30534ccec5f5ea59c25400cfc25c74a | 4/11/2023, 11:39:38.513 PM | 5/2/2023, 12:34:17.128 AM | [ { "id": "9cc92bab3b013e0b94caf1e21ec49f1dde3cf0d6", "name": "rnd-instance-managment", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | [] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2", "A.9.2.2", "A.9.4.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-05", "IAM-02" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 101379015902 | 101379015902 | Access to IaaS without MFA | 98691894310 | Require MFA for all IAM users Require MFA for all users in your IdP. If that is not possible, make sure that those with access to IaaS environments have MFA enabled. | rnd-instance-managment's AWS account does not have MFA enabled | false | https://msftriskyuser.authomize.com/incidents/3860b36bf30534ccec5f5ea59c25400cfc25c74a | Authomize_v2_CL | ||||||||||||||||
| 46 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:13.488 AM | 66af620951eedce503527ed18ce7508f060407b3 | 4/11/2023, 11:39:38.504 PM | 5/2/2023, 12:34:17.129 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | [] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2", "A.9.2.2", "A.9.4.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-05", "IAM-02" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 101379015902 | 101379015902 | Access to IaaS without MFA | 98691894310 | Require MFA for all IAM users Require MFA for all users in your IdP. If that is not possible, make sure that those with access to IaaS environments have MFA enabled. | cli user's AWS account does not have MFA enabled | false | https://msftriskyuser.authomize.com/incidents/66af620951eedce503527ed18ce7508f060407b3 | Authomize_v2_CL | ||||||||||||||||
| 47 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:13.488 AM | 78bb4135e03d1d468eb455ada05c038b0845cf6c | 4/11/2023, 11:39:38.492 PM | 5/2/2023, 12:34:17.129 AM | [ { "id": "04d5be4fda16548fdc0b0c7a20701cc4a108a769", "name": "AuthomizeCustomerRoleAssumer", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | [] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2", "A.9.2.2", "A.9.4.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-05", "IAM-02" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 101379015902 | 101379015902 | Access to IaaS without MFA | 98691894310 | Require MFA for all IAM users Require MFA for all users in your IdP. If that is not possible, make sure that those with access to IaaS environments have MFA enabled. | AuthomizeCustomerRoleAssumer's AWS account does not have MFA enabled | false | https://msftriskyuser.authomize.com/incidents/78bb4135e03d1d468eb455ada05c038b0845cf6c | Authomize_v2_CL | ||||||||||||||||
| 48 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:13.488 AM | 18115ae731a5340a864dac0096909b818980bf3e | 4/11/2023, 11:39:38.483 PM | 5/2/2023, 12:34:17.129 AM | [ { "id": "6147e2cb17bb389c1d97e274e0e844d1a30f3763", "name": "rnd-management", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | [] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2", "A.9.2.2", "A.9.4.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-05", "IAM-02" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 101379015902 | 101379015902 | Access to IaaS without MFA | 98691894310 | Require MFA for all IAM users Require MFA for all users in your IdP. If that is not possible, make sure that those with access to IaaS environments have MFA enabled. | rnd-management's AWS account does not have MFA enabled | false | https://msftriskyuser.authomize.com/incidents/18115ae731a5340a864dac0096909b818980bf3e | Authomize_v2_CL | ||||||||||||||||
| 49 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:13.488 AM | 796070fe32962e521ef51da816cc54a18b630f63 | 4/11/2023, 11:39:38.474 PM | 5/2/2023, 12:34:17.128 AM | [ { "id": "0dc77cd79ca8e4a97c12db8241463a9615d8f7f6", "name": "devop-admin", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | [] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2", "A.9.2.2", "A.9.4.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-05", "IAM-02" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 101379015902 | 101379015902 | Access to IaaS without MFA | 98691894310 | Require MFA for all IAM users Require MFA for all users in your IdP. If that is not possible, make sure that those with access to IaaS environments have MFA enabled. | devop-admin's AWS account does not have MFA enabled | false | https://msftriskyuser.authomize.com/incidents/796070fe32962e521ef51da816cc54a18b630f63 | Authomize_v2_CL | ||||||||||||||||
| 50 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:13.488 AM | 2b36cc9eeaaf57c4214aab548dd9bbc46215528b | 4/11/2023, 11:39:38.465 PM | 5/2/2023, 12:34:17.127 AM | [ { "id": "cba1878c0d07a5530b835a9198cd67dd3ab99502", "name": "AuthomizeMasterAccountUser", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | [] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2", "A.9.2.2", "A.9.4.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-05", "IAM-02" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 101379015902 | 101379015902 | Access to IaaS without MFA | 98691894310 | Require MFA for all IAM users Require MFA for all users in your IdP. If that is not possible, make sure that those with access to IaaS environments have MFA enabled. | AuthomizeMasterAccountUser's AWS account does not have MFA enabled | false | https://msftriskyuser.authomize.com/incidents/2b36cc9eeaaf57c4214aab548dd9bbc46215528b | Authomize_v2_CL | ||||||||||||||||
| 51 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:13.488 AM | a8d7cf9b45930d496696359e8d59d8dc498b3763 | 4/11/2023, 11:39:38.457 PM | 5/2/2023, 12:34:17.130 AM | [ { "id": "ef1aaecb0869343318c6e4af3e9bfe0326a68d9c", "name": "phillip carpenter@acme com", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | [] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2", "A.9.2.2", "A.9.4.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-05", "IAM-02" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 101379015902 | 101379015902 | Access to IaaS without MFA | 98691894310 | Require MFA for all IAM users Require MFA for all users in your IdP. If that is not possible, make sure that those with access to IaaS environments have MFA enabled. | phillip carpenter@acme com's AWS account does not have MFA enabled | false | https://msftriskyuser.authomize.com/incidents/a8d7cf9b45930d496696359e8d59d8dc498b3763 | Authomize_v2_CL | ||||||||||||||||
| 52 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:15.113 AM | 0ab6bf96deafe2f1fb2bbd3be22b6cf5b9690d34 | 4/11/2023, 11:39:38.450 PM | 5/2/2023, 12:34:17.127 AM | [ { "id": "95fb6c89a1dcd4d27797905a128aee1cef508898", "name": "role chaining user", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | [] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2", "A.9.2.2", "A.9.4.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-05", "IAM-02" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 101379015902 | 101379015902 | Access to IaaS without MFA | 98691894310 | Require MFA for all IAM users Require MFA for all users in your IdP. If that is not possible, make sure that those with access to IaaS environments have MFA enabled. | role chaining user's AWS account does not have MFA enabled | false | https://msftriskyuser.authomize.com/incidents/0ab6bf96deafe2f1fb2bbd3be22b6cf5b9690d34 | Authomize_v2_CL | ||||||||||||||||
| 53 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:15.113 AM | 31b1a176170005ef718f9b52e2a2ce5fd044e860 | 4/11/2023, 11:39:38.442 PM | 5/2/2023, 12:34:17.130 AM | [ { "id": "725737663b035a749c31dd80746bf014d1847f00", "name": "OktaSSOuser", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | [] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2", "A.9.2.2", "A.9.4.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-05", "IAM-02" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 101379015902 | 101379015902 | Access to IaaS without MFA | 98691894310 | Require MFA for all IAM users Require MFA for all users in your IdP. If that is not possible, make sure that those with access to IaaS environments have MFA enabled. | OktaSSOuser's AWS account does not have MFA enabled | false | https://msftriskyuser.authomize.com/incidents/31b1a176170005ef718f9b52e2a2ce5fd044e860 | Authomize_v2_CL | ||||||||||||||||
| 54 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:15.113 AM | 0367c367cc34aa7e5bc162f6f4dd37f369e0ca45 | 3/10/2023, 11:37:13.254 AM | 5/2/2023, 12:37:17.530 AM | [ { "id": "fd86c5571db19e742cb7add8d343d71b44a89926", "name": "frontend_test_instance", "object": "identity", "email": null }, { "id": "c77b58f3f69cf570e1fee1382bc98e0485ece2f2", "name": "role/ec2_lambda_access:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343500 | 74705343500 | New service account gained access to IaaS resource | 74701856303 | Keep access to sensitive resources using least privilege principle | frontend_test_instance gained access to Policy role/ec2_lambda_access:trustpolicy on AWS. Access was gained through ec2_lambda_access | false | https://msftriskyuser.authomize.com/incidents/0367c367cc34aa7e5bc162f6f4dd37f369e0ca45 | Authomize_v2_CL | |||||||||||||||
| 55 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:15.113 AM | 0dbb71620d5a0a22f48f285dd829be164863823d | 3/10/2023, 11:37:13.249 AM | 5/2/2023, 12:37:17.529 AM | [ { "id": "fd86c5571db19e742cb7add8d343d71b44a89926", "name": "frontend_test_instance", "object": "identity", "email": null }, { "id": "462e65ee4d96e06ac007384c63b4073edfc537eb", "name": "ec2_lambda_access", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343500 | 74705343500 | New service account gained access to IaaS resource | 74701856303 | Keep access to sensitive resources using least privilege principle | frontend_test_instance gained access to Resource_EntitlementProxy ec2_lambda_access on AWS. | false | https://msftriskyuser.authomize.com/incidents/0dbb71620d5a0a22f48f285dd829be164863823d | Authomize_v2_CL | |||||||||||||||
| 56 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:15.113 AM | ec309607df140c143a75df673f1be2249d7a883f | 3/10/2023, 11:37:13.244 AM | 5/2/2023, 12:37:17.530 AM | [ { "id": "5df981ccd3044d6cb56ebac473f91d5f97a180a5", "name": "frontend_views", "object": "identity", "email": null }, { "id": "e3198207a5cc29c1ec3d7edbe30f608e14926922", "name": "ec2_s3_full_access", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343500 | 74705343500 | New service account gained access to IaaS resource | 74701856303 | Keep access to sensitive resources using least privilege principle | frontend_views gained access to Resource_EntitlementProxy ec2_s3_full_access on AWS. | false | https://msftriskyuser.authomize.com/incidents/ec309607df140c143a75df673f1be2249d7a883f | Authomize_v2_CL | |||||||||||||||
| 57 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:15.113 AM | e7b7b8800efef7c2ef1120b1f756ef87e4ceb4a6 | 3/10/2023, 11:37:13.238 AM | 5/2/2023, 12:37:17.530 AM | [ { "id": "5df981ccd3044d6cb56ebac473f91d5f97a180a5", "name": "frontend_views", "object": "identity", "email": null }, { "id": "0a3d67239fd24a7aadbc2202ded521bba72deabe", "name": "role/ec2_s3_full_access:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343500 | 74705343500 | New service account gained access to IaaS resource | 74701856303 | Keep access to sensitive resources using least privilege principle | frontend_views gained access to Policy role/ec2_s3_full_access:trustpolicy on AWS. Access was gained through ec2_s3_full_access | false | https://msftriskyuser.authomize.com/incidents/e7b7b8800efef7c2ef1120b1f756ef87e4ceb4a6 | Authomize_v2_CL | |||||||||||||||
| 58 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:15.113 AM | 217cb5d016e95d6010d3e462cbe056f6b7d5066e | 3/10/2023, 11:37:06.079 AM | 5/2/2023, 12:33:06.155 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "f50d5abbb3ab5d07ea0fb91a38f5480808240c00", "name": "privesc15-PassExistingRoleToNewLambdaThenInvoke-role", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy privesc15-PassExistingRoleToNewLambdaThenInvoke-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/217cb5d016e95d6010d3e462cbe056f6b7d5066e | Authomize_v2_CL | |||||||||||||||
| 59 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:15.113 AM | e842897a7776e8a56b842bdedb65bee149f8f70b | 3/10/2023, 11:37:06.075 AM | 5/2/2023, 12:33:06.156 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "ee2e94100b8ecc36a2dc5949d97e409819443637", "name": "role/privesc15-passexistingroletonewlambdatheninvoke-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/privesc15-passexistingroletonewlambdatheninvoke-role:trustpolicy on AWS. Access was gained through privesc15-PassExistingRoleToNewLambdaThenInvoke-role | false | https://msftriskyuser.authomize.com/incidents/e842897a7776e8a56b842bdedb65bee149f8f70b | Authomize_v2_CL | |||||||||||||||
| 60 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:15.113 AM | f2c1d74adc75e3c31e5789af530619e1462feb34 | 3/10/2023, 11:37:06.070 AM | 5/2/2023, 12:33:06.157 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "fb233209f505dd3fc176b68219878f1cd6cf0b6b", "name": "role/privesc-sagemakercreatenotebookpassrole-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/privesc-sagemakercreatenotebookpassrole-role:trustpolicy on AWS. Access was gained through privesc-sageMakerCreateNotebookPassRole-role | false | https://msftriskyuser.authomize.com/incidents/f2c1d74adc75e3c31e5789af530619e1462feb34 | Authomize_v2_CL | |||||||||||||||
| 61 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:15.113 AM | cbdfcb23ce65bb273f4e93b00377cc144936f100 | 3/10/2023, 11:37:06.065 AM | 5/2/2023, 12:33:06.159 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "dbc2311d045329b3fea9cbeabd9de2cfbfa4bc78", "name": "privesc-sageMakerCreateNotebookPassRole-role", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy privesc-sageMakerCreateNotebookPassRole-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/cbdfcb23ce65bb273f4e93b00377cc144936f100 | Authomize_v2_CL | |||||||||||||||
| 62 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:16.707 AM | 150662ecc677be09e3cb64c64ffae37cf6e8545a | 3/10/2023, 11:37:06.060 AM | 5/2/2023, 12:33:06.155 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "e0a2e0a1f6a4b2bb06988c32a80e19cc68913c25", "name": "role/privesc14-updatingassumerolepolicy-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/privesc14-updatingassumerolepolicy-role:trustpolicy on AWS. Access was gained through privesc14-UpdatingAssumeRolePolicy-role | false | https://msftriskyuser.authomize.com/incidents/150662ecc677be09e3cb64c64ffae37cf6e8545a | Authomize_v2_CL | |||||||||||||||
| 63 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:16.707 AM | dbda66377c5fa6a570bfcde2a190510c6185c573 | 3/10/2023, 11:37:06.056 AM | 5/2/2023, 12:33:06.157 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "d9377f102c8508a677e8b567289e157996079155", "name": "privesc14-UpdatingAssumeRolePolicy-role", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy privesc14-UpdatingAssumeRolePolicy-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/dbda66377c5fa6a570bfcde2a190510c6185c573 | Authomize_v2_CL | |||||||||||||||
| 64 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:16.707 AM | 2c2d625a80346db442996238901ea8657ac8edd6 | 3/10/2023, 11:37:06.051 AM | 5/2/2023, 12:33:06.156 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "d8fc87b126080ec8a2ce699023d029345acfcec9", "name": "privesc12-PutRolePolicy-role", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy privesc12-PutRolePolicy-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/2c2d625a80346db442996238901ea8657ac8edd6 | Authomize_v2_CL | |||||||||||||||
| 65 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:16.707 AM | b41cf4d8d3784f8bc3b265204666e1955aca6fbb | 3/10/2023, 11:37:06.046 AM | 5/2/2023, 12:33:06.160 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "5c4ceaf1629f09e7b9d240e138d5a902f068577a", "name": "role/privesc12-putrolepolicy-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/privesc12-putrolepolicy-role:trustpolicy on AWS. Access was gained through privesc12-PutRolePolicy-role | false | https://msftriskyuser.authomize.com/incidents/b41cf4d8d3784f8bc3b265204666e1955aca6fbb | Authomize_v2_CL | |||||||||||||||
| 66 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:16.707 AM | 59b41d4266ab04283825274ca99d9494ea3dd73c | 3/10/2023, 11:37:06.041 AM | 5/2/2023, 12:33:06.156 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "d5a8159f651d16d46680955c9204e9621cf39812", "name": "privesc-sageMakerCreateProcessingJobPassRole-role", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy privesc-sageMakerCreateProcessingJobPassRole-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/59b41d4266ab04283825274ca99d9494ea3dd73c | Authomize_v2_CL | |||||||||||||||
| 67 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:16.707 AM | 9a6bc63c772cee21e97c9edb2e5a4c036816f996 | 3/10/2023, 11:37:06.037 AM | 5/2/2023, 12:33:11.085 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "6749d2c34828e74fdb645c18ea0b9790ae95a439", "name": "role/privesc-sagemakercreateprocessingjobpassrole-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/privesc-sagemakercreateprocessingjobpassrole-role:trustpolicy on AWS. Access was gained through privesc-sageMakerCreateProcessingJobPassRole-role | false | https://msftriskyuser.authomize.com/incidents/9a6bc63c772cee21e97c9edb2e5a4c036816f996 | Authomize_v2_CL | |||||||||||||||
| 68 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:16.707 AM | b619e70cb700f80baf7f9774b6b05de32ed5259f | 3/10/2023, 11:37:06.032 AM | 5/2/2023, 12:33:11.085 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "d4a580da19afe5ad7f3d05d18608d5167f80fd06", "name": "fp4-nonExploitableResourceConstraint-role", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy fp4-nonExploitableResourceConstraint-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/b619e70cb700f80baf7f9774b6b05de32ed5259f | Authomize_v2_CL | |||||||||||||||
| 69 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:16.707 AM | bbed4c9af9a421c8890708bc2a5754767990c69b | 3/10/2023, 11:37:06.026 AM | 5/2/2023, 12:33:11.084 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "7141077ab0a802fc1a6be7cc9ff4c5e25c695d50", "name": "role/fp4-nonexploitableresourceconstraint-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/fp4-nonexploitableresourceconstraint-role:trustpolicy on AWS. Access was gained through fp4-nonExploitableResourceConstraint-role | false | https://msftriskyuser.authomize.com/incidents/bbed4c9af9a421c8890708bc2a5754767990c69b | Authomize_v2_CL | |||||||||||||||
| 70 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:16.707 AM | 58522587365d4c5422048b71dfdaed9dd37d7dee | 3/10/2023, 11:37:06.021 AM | 5/2/2023, 12:33:06.160 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "d1df8487ca576e66adfd4eac11349e4c82da50b7", "name": "privesc-sageMakerCreateTrainingJobPassRole-role", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy privesc-sageMakerCreateTrainingJobPassRole-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/58522587365d4c5422048b71dfdaed9dd37d7dee | Authomize_v2_CL | |||||||||||||||
| 71 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:16.707 AM | 29496c72532ee7a0869e00d15c58e43991a3be7c | 3/10/2023, 11:37:06.016 AM | 5/2/2023, 12:33:06.161 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "c3cbd2580c2954cdb439a4b746c6dfeb7cd32bb0", "name": "role/privesc-sagemakercreatetrainingjobpassrole-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/privesc-sagemakercreatetrainingjobpassrole-role:trustpolicy on AWS. Access was gained through privesc-sageMakerCreateTrainingJobPassRole-role | false | https://msftriskyuser.authomize.com/incidents/29496c72532ee7a0869e00d15c58e43991a3be7c | Authomize_v2_CL | |||||||||||||||
| 72 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:19.447 AM | f062ff5eb7a238b61da885a263d51e174c371dff | 3/10/2023, 11:37:06.011 AM | 5/2/2023, 12:33:06.156 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "cddf050be9319c136bbbc01f17763201b64cf91b", "name": "privesc-ssmStartSession-role", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy privesc-ssmStartSession-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/f062ff5eb7a238b61da885a263d51e174c371dff | Authomize_v2_CL | |||||||||||||||
| 73 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:19.447 AM | 0f834068bb0c1cb88ea248ed4a62ee6f393af7f8 | 3/10/2023, 11:37:06.006 AM | 5/2/2023, 12:33:06.155 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "7a3724a3ca9fc14fcd1a1838a234c390c4811991", "name": "role/privesc-ssmstartsession-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/privesc-ssmstartsession-role:trustpolicy on AWS. Access was gained through privesc-ssmStartSession-role | false | https://msftriskyuser.authomize.com/incidents/0f834068bb0c1cb88ea248ed4a62ee6f393af7f8 | Authomize_v2_CL | |||||||||||||||
| 74 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:19.447 AM | 379fdf5a48ff4c6c22d5dc2e8dcd4e3368d91306 | 3/10/2023, 11:37:06.001 AM | 5/2/2023, 12:33:06.155 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "d7bb41efcf114d0c9011d9ed2c0cf6917c6c2256", "name": "role/privesc-sagemakercreatepresignednotebookurl-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/privesc-sagemakercreatepresignednotebookurl-role:trustpolicy on AWS. Access was gained through privesc-sageMakerCreatePresignedNotebookURL-role | false | https://msftriskyuser.authomize.com/incidents/379fdf5a48ff4c6c22d5dc2e8dcd4e3368d91306 | Authomize_v2_CL | |||||||||||||||
| 75 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:19.447 AM | 85a405adbc59caf7de1d21077cda203bc7cae3a0 | 3/10/2023, 11:37:05.995 AM | 5/2/2023, 12:33:06.155 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "c4df1e86fe83bfc346cfb23fd21f5a2e1d2b7b23", "name": "privesc-sageMakerCreatePresignedNotebookURL-role", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy privesc-sageMakerCreatePresignedNotebookURL-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/85a405adbc59caf7de1d21077cda203bc7cae3a0 | Authomize_v2_CL | |||||||||||||||
| 76 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:19.447 AM | fc9cd946f18aa7d01bf7cc70c3118951364ed7ef | 3/10/2023, 11:37:05.990 AM | 5/2/2023, 12:33:06.158 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "bf966f7b1b5c0e3169fbfb0f0e5bdd5200e03dfd", "name": "privesc16-PassRoleToNewLambdaThenTriggerWithNewDynamo-role", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy privesc16-PassRoleToNewLambdaThenTriggerWithNewDynamo-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/fc9cd946f18aa7d01bf7cc70c3118951364ed7ef | Authomize_v2_CL | |||||||||||||||
| 77 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:19.447 AM | a1a31542b163323f86366f5f9746389235421e29 | 3/10/2023, 11:37:05.986 AM | 5/2/2023, 12:33:06.157 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "4b64c9e25d7c3c70cc4fd63f11492082ce4f05ac", "name": "role/privesc16-passroletonewlambdathentriggerwithnewdynamo-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/privesc16-passroletonewlambdathentriggerwithnewdynamo-role:trustpolicy on AWS. Access was gained through privesc16-PassRoleToNewLambdaThenTriggerWithNewDynamo-role | false | https://msftriskyuser.authomize.com/incidents/a1a31542b163323f86366f5f9746389235421e29 | Authomize_v2_CL | |||||||||||||||
| 78 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:19.447 AM | 9d4fb9843c0f4880e1e23532b8db724b35cdee1c | 3/10/2023, 11:37:05.981 AM | 5/2/2023, 12:33:11.085 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "b494fd2e5c32528f6f7868d28ce0bddb813efdc7", "name": "privesc1-CreateNewPolicyVersion-role", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy privesc1-CreateNewPolicyVersion-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/9d4fb9843c0f4880e1e23532b8db724b35cdee1c | Authomize_v2_CL | |||||||||||||||
| 79 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:19.447 AM | 70482343f0d4b0092610166c03cbc24b1ae57e70 | 3/10/2023, 11:37:05.962 AM | 5/2/2023, 12:33:06.159 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "942cfa15536f0d202fc4f9a53b1c2d3d93c800b4", "name": "role/privesc1-createnewpolicyversion-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/privesc1-createnewpolicyversion-role:trustpolicy on AWS. Access was gained through privesc1-CreateNewPolicyVersion-role | false | https://msftriskyuser.authomize.com/incidents/70482343f0d4b0092610166c03cbc24b1ae57e70 | Authomize_v2_CL | |||||||||||||||
| 80 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:19.447 AM | f94caed3ac9b51d90a94141da7add28139c1add4 | 3/10/2023, 11:37:05.956 AM | 5/2/2023, 12:33:11.086 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "b4153b031bdd8330d38d3abad9a3d5c443394a2a", "name": "privesc2-SetExistingDefaultPolicyVersion-role", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy privesc2-SetExistingDefaultPolicyVersion-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/f94caed3ac9b51d90a94141da7add28139c1add4 | Authomize_v2_CL | |||||||||||||||
| 81 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:19.447 AM | bd61030613357183abe07143c9db1a76e9352219 | 3/10/2023, 11:37:05.951 AM | 5/2/2023, 12:33:06.159 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "0e56b2aefad3817948927b8f0237c4f05a159a5f", "name": "role/privesc2-setexistingdefaultpolicyversion-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/privesc2-setexistingdefaultpolicyversion-role:trustpolicy on AWS. Access was gained through privesc2-SetExistingDefaultPolicyVersion-role | false | https://msftriskyuser.authomize.com/incidents/bd61030613357183abe07143c9db1a76e9352219 | Authomize_v2_CL | |||||||||||||||
| 82 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:20.925 AM | 0fc47795d82e5b50e680465390a793a1d7bcbe07 | 3/10/2023, 11:37:05.946 AM | 5/2/2023, 12:33:06.158 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "b269dc8baee39ca165438afc16edaf86fb90e918", "name": "privesc19-UpdateExistingGlueDevEndpoint-role", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy privesc19-UpdateExistingGlueDevEndpoint-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/0fc47795d82e5b50e680465390a793a1d7bcbe07 | Authomize_v2_CL | |||||||||||||||
| 83 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:20.925 AM | 68f6523f2f76a8e5b4f932512a567b7f21c8afd3 | 3/10/2023, 11:37:05.941 AM | 5/2/2023, 12:33:06.161 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "885a3825218441613f6ac495700378c2f60bee42", "name": "role/privesc19-updateexistinggluedevendpoint-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/privesc19-updateexistinggluedevendpoint-role:trustpolicy on AWS. Access was gained through privesc19-UpdateExistingGlueDevEndpoint-role | false | https://msftriskyuser.authomize.com/incidents/68f6523f2f76a8e5b4f932512a567b7f21c8afd3 | Authomize_v2_CL | |||||||||||||||
| 84 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:20.925 AM | 0141e4fe10937f263e494a7b5db0d3b0dc9bbed7 | 3/10/2023, 11:37:05.937 AM | 5/2/2023, 12:33:06.159 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "ab6c48b7204fb3f965f2e352cbc085b7925e5b7c", "name": "privesc17-EditExistingLambdaFunctionWithRole-role", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy privesc17-EditExistingLambdaFunctionWithRole-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/0141e4fe10937f263e494a7b5db0d3b0dc9bbed7 | Authomize_v2_CL | |||||||||||||||
| 85 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:20.925 AM | b47330fd60e106a221b8f7f649ce163e18d2e39f | 3/10/2023, 11:37:05.932 AM | 5/2/2023, 12:33:11.084 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "8af146306cca1c04f966a1dbbaca93d1217a76cc", "name": "role/privesc17-editexistinglambdafunctionwithrole-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/privesc17-editexistinglambdafunctionwithrole-role:trustpolicy on AWS. Access was gained through privesc17-EditExistingLambdaFunctionWithRole-role | false | https://msftriskyuser.authomize.com/incidents/b47330fd60e106a221b8f7f649ce163e18d2e39f | Authomize_v2_CL | |||||||||||||||
| 86 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:20.925 AM | e284457cc39a03b3bd0a385530df34df3e11c548 | 3/10/2023, 11:37:05.926 AM | 5/2/2023, 12:33:11.086 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "a7611d98d4f3ad0d12fcd0f709c57b6a1351c2ef", "name": "privesc10-PutUserPolicy-role", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy privesc10-PutUserPolicy-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/e284457cc39a03b3bd0a385530df34df3e11c548 | Authomize_v2_CL | |||||||||||||||
| 87 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:20.925 AM | c15dda8f724a707f3709b8fc7c60f8b6e530b07b | 3/10/2023, 11:37:05.921 AM | 5/2/2023, 12:33:11.083 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "5fe59a62623191d018e1c99085d8f136b1eaa050", "name": "role/privesc10-putuserpolicy-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/privesc10-putuserpolicy-role:trustpolicy on AWS. Access was gained through privesc10-PutUserPolicy-role | false | https://msftriskyuser.authomize.com/incidents/c15dda8f724a707f3709b8fc7c60f8b6e530b07b | Authomize_v2_CL | |||||||||||||||
| 88 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:20.925 AM | 42ca4fe3783fa478bc95b1544b68eb22027ed005 | 3/10/2023, 11:37:05.916 AM | 5/2/2023, 12:33:06.157 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "9fc1d76c057711407ea3862c897a89a8b93feea3", "name": "create-access-keys-role", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy create-access-keys-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/42ca4fe3783fa478bc95b1544b68eb22027ed005 | Authomize_v2_CL | |||||||||||||||
| 89 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:20.925 AM | 2629436ed5ce4dcd26573bc6bb13f8c434e49701 | 3/10/2023, 11:37:05.911 AM | 5/2/2023, 12:33:06.156 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "602e3dc786dc0ef5d06759af7e495b283fef8809", "name": "role/create-access-keys-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/create-access-keys-role:trustpolicy on AWS. Access was gained through create-access-keys-role | false | https://msftriskyuser.authomize.com/incidents/2629436ed5ce4dcd26573bc6bb13f8c434e49701 | Authomize_v2_CL | |||||||||||||||
| 90 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:20.925 AM | 93658d401fed5aa8b7e043af6a163628867b83ae | 3/10/2023, 11:37:05.906 AM | 5/2/2023, 12:33:06.156 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "940fefa56a0e62ab8ab8add131d055b520853419", "name": "privesc9-AttachRolePolicy-role", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy privesc9-AttachRolePolicy-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/93658d401fed5aa8b7e043af6a163628867b83ae | Authomize_v2_CL | |||||||||||||||
| 91 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:20.925 AM | e61d255543946f41dfe55817d0ec8835ca7eb284 | 3/10/2023, 11:37:05.901 AM | 5/2/2023, 12:33:06.159 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "3e8b4570904f217a591f6aa6c99d652377e64f94", "name": "role/privesc9-attachrolepolicy-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/privesc9-attachrolepolicy-role:trustpolicy on AWS. Access was gained through privesc9-AttachRolePolicy-role | false | https://msftriskyuser.authomize.com/incidents/e61d255543946f41dfe55817d0ec8835ca7eb284 | Authomize_v2_CL | |||||||||||||||
| 92 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:22.183 AM | f012fc16260f03491a6889a1581f4298cd358ab9 | 3/10/2023, 11:37:05.896 AM | 5/2/2023, 12:33:06.160 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "f1828320bc23e58be6ad1cf35e296690df6eb6e8", "name": "role/fp5-nonexploitableconditionconstraint-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/fp5-nonexploitableconditionconstraint-role:trustpolicy on AWS. Access was gained through fp5-nonExploitableConditionConstraint-role | false | https://msftriskyuser.authomize.com/incidents/f012fc16260f03491a6889a1581f4298cd358ab9 | Authomize_v2_CL | |||||||||||||||
| 93 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:22.183 AM | 2b6cb2229d396d41bc61558cbcdc6a569d47d6bc | 3/10/2023, 11:37:05.890 AM | 5/2/2023, 12:33:06.160 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "9229c4accf51a21823ae293ef77f306a8abcc3ff", "name": "fp5-nonExploitableConditionConstraint-role", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy fp5-nonExploitableConditionConstraint-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/2b6cb2229d396d41bc61558cbcdc6a569d47d6bc | Authomize_v2_CL | |||||||||||||||
| 94 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:22.183 AM | a354e6ab06fa2c20c1cd67f61683575d51dbd3ed | 3/10/2023, 11:37:05.885 AM | 5/2/2023, 12:33:11.084 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "88d2e219e689f6585e2251b8da785d10ff0f8fdc", "name": "privesc-CloudFormationUpdateStack-role", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy privesc-CloudFormationUpdateStack-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/a354e6ab06fa2c20c1cd67f61683575d51dbd3ed | Authomize_v2_CL | |||||||||||||||
| 95 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:22.183 AM | 3c359bbd23e8c3db0ffb0493c4869d50a51c44ff | 3/10/2023, 11:37:05.880 AM | 5/2/2023, 12:33:06.158 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "6fa8dff1bc10d6522b60c23e623167d49768dda5", "name": "role/privesc-cloudformationupdatestack-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/privesc-cloudformationupdatestack-role:trustpolicy on AWS. Access was gained through privesc-CloudFormationUpdateStack-role | false | https://msftriskyuser.authomize.com/incidents/3c359bbd23e8c3db0ffb0493c4869d50a51c44ff | Authomize_v2_CL | |||||||||||||||
| 96 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:22.183 AM | af881e76a84c5b949f76cd866ebabdd771862f5a | 3/10/2023, 11:37:05.876 AM | 5/2/2023, 12:33:11.084 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "ab4353a13e64f6eb5789a253d8db3934261c087f", "name": "role/privesc-assumerole-starting-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/privesc-assumerole-starting-role:trustpolicy on AWS. Access was gained through privesc-AssumeRole-starting-role | false | https://msftriskyuser.authomize.com/incidents/af881e76a84c5b949f76cd866ebabdd771862f5a | Authomize_v2_CL | |||||||||||||||
| 97 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:22.183 AM | 50cb08d391447c92bcff12627a23df3ce832c06f | 3/10/2023, 11:37:05.871 AM | 5/2/2023, 12:33:06.157 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "87b44b3f24fba7b2e8197dd53b851401ccbebceb", "name": "privesc-AssumeRole-starting-role", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy privesc-AssumeRole-starting-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/50cb08d391447c92bcff12627a23df3ce832c06f | Authomize_v2_CL | |||||||||||||||
| 98 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:22.183 AM | c39eb4d79767e2f7a25a28919e533005961c76d1 | 3/10/2023, 11:37:05.866 AM | 5/2/2023, 12:33:06.160 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "fff633e9f66b872e5be89c43e5cf7ffc2302d89e", "name": "role/fn4-exploitablenotaction-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/fn4-exploitablenotaction-role:trustpolicy on AWS. Access was gained through fn4-exploitableNotAction-role | false | https://msftriskyuser.authomize.com/incidents/c39eb4d79767e2f7a25a28919e533005961c76d1 | Authomize_v2_CL | |||||||||||||||
| 99 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:22.183 AM | 6d3f748c564a6168260706784475de3b24b884f0 | 3/10/2023, 11:37:05.856 AM | 5/2/2023, 12:33:06.161 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "853de653f97253e4f420001af753612ff29c262d", "name": "fn4-exploitableNotAction-role", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy fn4-exploitableNotAction-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/6d3f748c564a6168260706784475de3b24b884f0 | Authomize_v2_CL | |||||||||||||||
| 100 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:22.183 AM | dbb98f19daf8c94b9523941d245a63c4284c8664 | 3/10/2023, 11:37:05.851 AM | 5/2/2023, 12:33:11.084 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "801f5f170cf9a26856903a01df19cbbbbd5d942b", "name": "fn2-exploitableResourceConstraint-role", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy fn2-exploitableResourceConstraint-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/dbb98f19daf8c94b9523941d245a63c4284c8664 | Authomize_v2_CL | |||||||||||||||
| 101 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:22.183 AM | a3ef0ab63ba1a9cc4f3389c61c2644d70d29145f | 3/10/2023, 11:37:05.845 AM | 5/2/2023, 12:33:06.161 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "30e36dc0af494bd8df7a9d6bbc7497748644dcf2", "name": "role/fn2-exploitableresourceconstraint-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/fn2-exploitableresourceconstraint-role:trustpolicy on AWS. Access was gained through fn2-exploitableResourceConstraint-role | false | https://msftriskyuser.authomize.com/incidents/a3ef0ab63ba1a9cc4f3389c61c2644d70d29145f | Authomize_v2_CL | |||||||||||||||
| 102 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:23.322 AM | c89b23b4fba5ecf5964d053210890321ba2bedef | 3/10/2023, 11:37:05.840 AM | 5/2/2023, 12:33:11.086 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "d5150dd049c95f34d89d7095f19cacaa547ca7a1", "name": "role/privesc3-createec2withexistinginstanceprofile-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/privesc3-createec2withexistinginstanceprofile-role:trustpolicy on AWS. Access was gained through privesc3-CreateEC2WithExistingInstanceProfile-role | false | https://msftriskyuser.authomize.com/incidents/c89b23b4fba5ecf5964d053210890321ba2bedef | Authomize_v2_CL | |||||||||||||||
| 103 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:23.322 AM | 961b721fc94ba45a14bd1b56738b4884d74ce169 | 3/10/2023, 11:37:05.835 AM | 5/2/2023, 12:33:06.157 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "75a27b50975d7a1a5dca723ddc36a96e1aaa8509", "name": "privesc3-CreateEC2WithExistingInstanceProfile-role", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy privesc3-CreateEC2WithExistingInstanceProfile-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/961b721fc94ba45a14bd1b56738b4884d74ce169 | Authomize_v2_CL | |||||||||||||||
| 104 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:23.322 AM | 689e3b8955344058530259ad09c05645ab7708e3 | 3/10/2023, 11:37:05.830 AM | 5/2/2023, 12:33:06.156 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "e64d734a0506dd2ef9c44e30eed19bcec2a75159", "name": "role/attach-role-to-user-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/attach-role-to-user-role:trustpolicy on AWS. Access was gained through role/attach-role-to-user-role | false | https://msftriskyuser.authomize.com/incidents/689e3b8955344058530259ad09c05645ab7708e3 | Authomize_v2_CL | |||||||||||||||
| 105 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:23.322 AM | db7749c89171a7d1342e040d36ccc6731399a8a1 | 3/10/2023, 11:37:05.825 AM | 5/2/2023, 12:33:11.084 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "c96763fe022295abbad74de37214777fcc4feeb9", "name": "role/attach-role-to-user-role:allows_assume_okta_ec2", "object": "asset", "originId": null, "originType": "InlinePolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/attach-role-to-user-role:allows_assume_okta_ec2 on AWS. Access was gained through role/attach-role-to-user-role | false | https://msftriskyuser.authomize.com/incidents/db7749c89171a7d1342e040d36ccc6731399a8a1 | Authomize_v2_CL | |||||||||||||||
| 106 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:23.322 AM | 713e159968e7356a0c790eef44cb123fa26e4f5a | 3/10/2023, 11:37:05.820 AM | 5/2/2023, 12:33:06.159 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "73828764631bdaf0e42bfb70c34280930b2ab3bd", "name": "role/attach-role-to-user-role", "object": "asset", "originId": null, "originType": "ARNResourceReference" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy role/attach-role-to-user-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/713e159968e7356a0c790eef44cb123fa26e4f5a | Authomize_v2_CL | |||||||||||||||
| 107 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:23.322 AM | de6fbad03eaf9b016278add8890eff637e138ee5 | 3/10/2023, 11:37:05.815 AM | 5/2/2023, 12:33:06.159 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "9258cb9fc9f3269e4c9ae36d8baf25e4633a6c7e", "name": "role/privesc13-addusertogroup-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/privesc13-addusertogroup-role:trustpolicy on AWS. Access was gained through privesc13-AddUserToGroup-role | false | https://msftriskyuser.authomize.com/incidents/de6fbad03eaf9b016278add8890eff637e138ee5 | Authomize_v2_CL | |||||||||||||||
| 108 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:23.322 AM | 166608450558c319ac4a3a7bad0e5ca05169b040 | 3/10/2023, 11:37:05.809 AM | 5/2/2023, 12:33:11.084 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "71fa0143ff61aecc431735e3b651dc7a369b39e3", "name": "privesc13-AddUserToGroup-role", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy privesc13-AddUserToGroup-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/166608450558c319ac4a3a7bad0e5ca05169b040 | Authomize_v2_CL | |||||||||||||||
| 109 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:23.322 AM | 45b3351bab9b6c700cff467d97ffd89e76039ae6 | 3/10/2023, 11:37:05.803 AM | 5/2/2023, 12:33:06.161 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "69cf4fc1de7f83e1824e319a4cd812216cefab02", "name": "role/privesc11-putgrouppolicy-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/privesc11-putgrouppolicy-role:trustpolicy on AWS. Access was gained through privesc11-PutGroupPolicy-role | false | https://msftriskyuser.authomize.com/incidents/45b3351bab9b6c700cff467d97ffd89e76039ae6 | Authomize_v2_CL | |||||||||||||||
| 110 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:23.322 AM | 8c4fb6211f4e9ce47fff7329b4b8ec9c8cff76ca | 3/10/2023, 11:37:05.797 AM | 5/2/2023, 12:33:11.085 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "6873537cf8bccdb37e5c33c3f33f69237c92583a", "name": "privesc11-PutGroupPolicy-role", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy privesc11-PutGroupPolicy-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/8c4fb6211f4e9ce47fff7329b4b8ec9c8cff76ca | Authomize_v2_CL | |||||||||||||||
| 111 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:23.322 AM | 764f934c7b041f65ba2fc8c6f7a66d78388f04ba | 3/10/2023, 11:37:05.791 AM | 5/2/2023, 12:33:06.158 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "e38d881dfd2def4435ce29500b8d1e85cc80003c", "name": "role/run-ec2-instances-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/run-ec2-instances-role:trustpolicy on AWS. Access was gained through run-ec2-instances-role | false | https://msftriskyuser.authomize.com/incidents/764f934c7b041f65ba2fc8c6f7a66d78388f04ba | Authomize_v2_CL | |||||||||||||||
| 112 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:24.992 AM | 157b4900389bb1a499748e4d5ff5f173b5fcd40c | 3/10/2023, 11:37:05.785 AM | 5/2/2023, 12:33:11.086 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "63dfa33250dc4f9ce7aa220d45e6c7e62fa71770", "name": "run-ec2-instances-role", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy run-ec2-instances-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/157b4900389bb1a499748e4d5ff5f173b5fcd40c | Authomize_v2_CL | |||||||||||||||
| 113 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:24.992 AM | 625b5c4f42f637e7ec25d1e9e7c852c763cd8fa9 | 3/10/2023, 11:37:05.779 AM | 5/2/2023, 12:33:11.085 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "633007f97eccb6d8b59a0b87766441abe060e9d6", "name": "privesc18-PassExistingRoleToNewGlueDevEndpoint-role", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy privesc18-PassExistingRoleToNewGlueDevEndpoint-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/625b5c4f42f637e7ec25d1e9e7c852c763cd8fa9 | Authomize_v2_CL | |||||||||||||||
| 114 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:24.992 AM | 1605591b6b91399c61d8f34ed0d73b2e2c87771b | 3/10/2023, 11:37:05.773 AM | 5/2/2023, 12:33:06.160 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "41e53ce9ccc996b7650123d59577072cff7424e6", "name": "role/privesc18-passexistingroletonewgluedevendpoint-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/privesc18-passexistingroletonewgluedevendpoint-role:trustpolicy on AWS. Access was gained through privesc18-PassExistingRoleToNewGlueDevEndpoint-role | false | https://msftriskyuser.authomize.com/incidents/1605591b6b91399c61d8f34ed0d73b2e2c87771b | Authomize_v2_CL | |||||||||||||||
| 115 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:24.992 AM | 54c556a40acd5e81a9a9023d728a81592c91a9ac | 3/10/2023, 11:37:05.767 AM | 5/2/2023, 12:33:06.158 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "66809f0a2e2145c88ae420ec9af2f8b19aae4e64", "name": "role/privesc-codebuildcreateprojectpassrole-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/privesc-codebuildcreateprojectpassrole-role:trustpolicy on AWS. Access was gained through privesc-codeBuildCreateProjectPassRole-role | false | https://msftriskyuser.authomize.com/incidents/54c556a40acd5e81a9a9023d728a81592c91a9ac | Authomize_v2_CL | |||||||||||||||
| 116 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:24.992 AM | ab40ab1386b79dad2110bdcdb3412bba440631a6 | 3/10/2023, 11:37:05.761 AM | 5/2/2023, 12:33:06.160 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "51b5a3ccd5e64d1fd471f6d89c50a0d59035211e", "name": "privesc-codeBuildCreateProjectPassRole-role", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy privesc-codeBuildCreateProjectPassRole-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/ab40ab1386b79dad2110bdcdb3412bba440631a6 | Authomize_v2_CL | |||||||||||||||
| 117 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:24.992 AM | f8b028af36b906fcbb43ad5850f6a7e44b554e0c | 3/10/2023, 11:37:05.755 AM | 5/2/2023, 12:33:06.161 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "8628c26bf1421e011adfb06ddea2d3322f0e58c1", "name": "role/privesc21-passexistingroletonewdatapipeline-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/privesc21-passexistingroletonewdatapipeline-role:trustpolicy on AWS. Access was gained through privesc21-PassExistingRoleToNewDataPipeline-role | false | https://msftriskyuser.authomize.com/incidents/f8b028af36b906fcbb43ad5850f6a7e44b554e0c | Authomize_v2_CL | |||||||||||||||
| 118 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:24.992 AM | 8e4078bc29bfb399c5051d6d275b0958efdafad1 | 3/10/2023, 11:37:05.748 AM | 5/2/2023, 12:33:06.155 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "4b51b92b8369d39cdd0964f383d2e195b4b15c1f", "name": "privesc21-PassExistingRoleToNewDataPipeline-role", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy privesc21-PassExistingRoleToNewDataPipeline-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/8e4078bc29bfb399c5051d6d275b0958efdafad1 | Authomize_v2_CL | |||||||||||||||
| 119 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:24.992 AM | 0ba734b57bbc1fb37581607f3636a499c22e4e40 | 3/10/2023, 11:37:05.742 AM | 5/2/2023, 12:33:06.158 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "95927e4f979bbf2fdbf9069547a687215339bc6e", "name": "role/allow-attaching-group-policy-role:trustpolicy", "object": "asset", "originId": null, "originType": "TrustPolicy" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Policy role/allow-attaching-group-policy-role:trustpolicy on AWS. Access was gained through allow-attaching-group-policy-role | false | https://msftriskyuser.authomize.com/incidents/0ba734b57bbc1fb37581607f3636a499c22e4e40 | Authomize_v2_CL | |||||||||||||||
| 120 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:24.992 AM | 8c1515f5cfdabe672d3e5c79859e31a691bd17cb | 3/10/2023, 11:37:05.736 AM | 5/2/2023, 12:33:06.158 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "3d891e577b103cdda7480a5c353e98146af05a68", "name": "allow-attaching-group-policy-role", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy allow-attaching-group-policy-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/8c1515f5cfdabe672d3e5c79859e31a691bd17cb | Authomize_v2_CL | |||||||||||||||
| 121 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:24.992 AM | 8f9a010c7c855c277825005e7e22d992fea3d2cc | 3/10/2023, 11:37:05.730 AM | 5/2/2023, 12:33:06.157 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null }, { "id": "16ef563d039853490c23b871dadd27ca3c05eff1", "name": "allow-ec2-connection-role", "object": "asset", "originId": null, "originType": "IAMRole" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Exposure | [] | [ { "values": [ "IAM-01", "IAM-03", "IAM-05", "DSP-01", "DSP-07", "DSP-08" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.1", "A.9.4.1", "A.13.2.1", "A.8.3.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.7" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-02", "DSI-04" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Medium | 74705343091 | 74705343091 | New direct access policy was granted against organizational policy | 74701856303 | Keep access to sensitive resources using least privilege principle | cli user gained access to Resource_EntitlementProxy allow-ec2-connection-role on AWS. | false | https://msftriskyuser.authomize.com/incidents/8f9a010c7c855c277825005e7e22d992fea3d2cc | Authomize_v2_CL | |||||||||||||||
| 122 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:27.863 AM | 0406647c740f9a32d5011174023a26c58cca4d6d | 3/9/2023, 11:37:10.027 PM | 5/2/2023, 12:37:26.310 AM | [ { "id": "9a5615f8555b373e68c4f600904d87b66f143b4a", "name": "74aed80d85fccde22d4af34ff872f8d1", "object": "identity", "email": null }, { "id": "3ec2b2ee3da9189992cedccf1ca13baf9023d55c", "name": "74aed80d85fccde22d4af34ff872f8d1", "object": "account", "originId": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Change Management | [ "Defense Evasion", "Lateral Movement", "Persistence", "Privilege Escalation" ] | [ { "values": [ "6.2", "5.3" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "CC6.2", "CC6.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" } ] | [ "Account Manipulation", "Valid Accounts" ] | Open | Medium | 74705343919 | 74705343919 | Empty group with entitlements | 74701857016 | It is advisable to remove this group. | The group 74aed80d85fccde22d4af34ff872f8d1 has no members but is entitled to one or more assets. | false | https://msftriskyuser.authomize.com/incidents/0406647c740f9a32d5011174023a26c58cca4d6d | Authomize_v2_CL | |||||||||||||||
| 123 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:27.863 AM | dc3a1ac14b8bc713c90038fe5bc15ee3074e48bf | 3/9/2023, 11:37:10.023 PM | 5/2/2023, 12:37:26.307 AM | [ { "id": "59c8849bfeb3b6de260f2dc2057c6ae2a879e0ea", "name": "aad", "object": "identity", "email": null }, { "id": "8808bef5dfccc8d1dab062f5973c240ac4797074", "name": "aad", "object": "account", "originId": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Change Management | [ "Defense Evasion", "Lateral Movement", "Persistence", "Privilege Escalation" ] | [ { "values": [ "6.2", "5.3" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "CC6.2", "CC6.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" } ] | [ "Account Manipulation", "Valid Accounts" ] | Open | Medium | 74705343919 | 74705343919 | Empty group with entitlements | 74701857016 | It is advisable to remove this group. | The group aad has no members but is entitled to one or more assets. | false | https://msftriskyuser.authomize.com/incidents/dc3a1ac14b8bc713c90038fe5bc15ee3074e48bf | Authomize_v2_CL | |||||||||||||||
| 124 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:27.863 AM | e844d0af6b1401b248b8afe937d187ae1e1adfad | 3/9/2023, 11:37:10.018 PM | 5/2/2023, 12:37:26.311 AM | [ { "id": "2b25c71d57c88af66ed054ff0b7692d38adc3c29", "name": "ping", "object": "identity", "email": null }, { "id": "a19591fcb668522d1e9fd5204a6101ea00f8a652", "name": "ping", "object": "account", "originId": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Change Management | [ "Defense Evasion", "Lateral Movement", "Persistence", "Privilege Escalation" ] | [ { "values": [ "6.2", "5.3" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "CC6.2", "CC6.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" } ] | [ "Account Manipulation", "Valid Accounts" ] | Open | Medium | 74705343919 | 74705343919 | Empty group with entitlements | 74701857016 | It is advisable to remove this group. | The group ping has no members but is entitled to one or more assets. | false | https://msftriskyuser.authomize.com/incidents/e844d0af6b1401b248b8afe937d187ae1e1adfad | Authomize_v2_CL | |||||||||||||||
| 125 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:27.863 AM | 7c304bdee9517f72433859897bf5e01e628483fd | 3/9/2023, 11:37:10.013 PM | 5/2/2023, 12:37:26.309 AM | [ { "id": "f870fbe62136eb523d5a59d6e179e90ae4547f70", "name": "awssso_cdfbc25a58c2a6fc_do_not_delete", "object": "identity", "email": null }, { "id": "5b6079b142b9e85b77f945abfdbaac1081779a2c", "name": "awssso_cdfbc25a58c2a6fc_do_not_delete", "object": "account", "originId": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Change Management | [ "Defense Evasion", "Lateral Movement", "Persistence", "Privilege Escalation" ] | [ { "values": [ "6.2", "5.3" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "CC6.2", "CC6.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" } ] | [ "Account Manipulation", "Valid Accounts" ] | Open | Medium | 74705343919 | 74705343919 | Empty group with entitlements | 74701857016 | It is advisable to remove this group. | The group awssso_cdfbc25a58c2a6fc_do_not_delete has no members but is entitled to one or more assets. | false | https://msftriskyuser.authomize.com/incidents/7c304bdee9517f72433859897bf5e01e628483fd | Authomize_v2_CL | |||||||||||||||
| 126 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:27.863 AM | 2fe3d024ddfc93d86b105141d4bc4c1fefdc6bca | 3/9/2023, 11:37:10.008 PM | 5/2/2023, 12:37:26.307 AM | [ { "id": "b005eb28050246738798d00a233bf49c9cbdc09b", "name": "aad", "object": "identity", "email": null }, { "id": "90a5df00a47f4b267c6f8143f7ef2b8e21c60bd6", "name": "aad", "object": "account", "originId": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Change Management | [ "Defense Evasion", "Lateral Movement", "Persistence", "Privilege Escalation" ] | [ { "values": [ "6.2", "5.3" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "CC6.2", "CC6.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" } ] | [ "Account Manipulation", "Valid Accounts" ] | Open | Medium | 74705343919 | 74705343919 | Empty group with entitlements | 74701857016 | It is advisable to remove this group. | The group aad has no members but is entitled to one or more assets. | false | https://msftriskyuser.authomize.com/incidents/2fe3d024ddfc93d86b105141d4bc4c1fefdc6bca | Authomize_v2_CL | |||||||||||||||
| 127 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:27.863 AM | b221c36015f21d4d200615109ca2d3b20a58c0a3 | 3/9/2023, 11:37:10.003 PM | 5/2/2023, 12:37:26.311 AM | [ { "id": "25e0277a33b6b36e04bd448c5eb857a34eeb6036", "name": "okta", "object": "identity", "email": null }, { "id": "ed46db938148de8acddbeb17eaa539bfd4c3d2a5", "name": "okta", "object": "account", "originId": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Change Management | [ "Defense Evasion", "Lateral Movement", "Persistence", "Privilege Escalation" ] | [ { "values": [ "6.2", "5.3" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "CC6.2", "CC6.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" } ] | [ "Account Manipulation", "Valid Accounts" ] | Open | Medium | 74705343919 | 74705343919 | Empty group with entitlements | 74701857016 | It is advisable to remove this group. | The group okta has no members but is entitled to one or more assets. | false | https://msftriskyuser.authomize.com/incidents/b221c36015f21d4d200615109ca2d3b20a58c0a3 | Authomize_v2_CL | |||||||||||||||
| 128 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:27.863 AM | 87e30d59f2090db9daf268a119981d778e833e58 | 3/9/2023, 8:37:33.843 PM | 5/2/2023, 12:37:26.309 AM | [ { "id": "7984be6be6de0d035d6c0f667ee807f8de4780c6", "name": "awssso_8abf30e4d8fe68a1_do_not_delete", "object": "identity", "email": null }, { "id": "3363ffd9d6115c17d4432999d6bf663fa8e9e938", "name": "awssso_8abf30e4d8fe68a1_do_not_delete", "object": "account", "originId": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Change Management | [ "Defense Evasion", "Lateral Movement", "Persistence", "Privilege Escalation" ] | [ { "values": [ "6.2", "5.3" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "CC6.2", "CC6.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" } ] | [ "Account Manipulation", "Valid Accounts" ] | Open | Medium | 74705343919 | 74705343919 | Empty group with entitlements | 74701857016 | It is advisable to remove this group. | The group awssso_8abf30e4d8fe68a1_do_not_delete has no members but is entitled to one or more assets. | false | https://msftriskyuser.authomize.com/incidents/87e30d59f2090db9daf268a119981d778e833e58 | Authomize_v2_CL | |||||||||||||||
| 129 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:27.863 AM | 1b1d87cf22421895050fc0d5a134ff6e964d1d9e | 3/9/2023, 8:37:33.831 PM | 5/2/2023, 12:37:26.307 AM | [ { "id": "8eb7fde8df0b16cd329646a21e83bfc3d85a5f35", "name": "aad", "object": "identity", "email": null }, { "id": "0e1b318409a2ec8f14dafe0e2e8c2eb68806f892", "name": "aad", "object": "account", "originId": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Change Management | [ "Defense Evasion", "Lateral Movement", "Persistence", "Privilege Escalation" ] | [ { "values": [ "6.2", "5.3" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "CC6.2", "CC6.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" } ] | [ "Account Manipulation", "Valid Accounts" ] | Open | Medium | 74705343919 | 74705343919 | Empty group with entitlements | 74701857016 | It is advisable to remove this group. | The group aad has no members but is entitled to one or more assets. | false | https://msftriskyuser.authomize.com/incidents/1b1d87cf22421895050fc0d5a134ff6e964d1d9e | Authomize_v2_CL | |||||||||||||||
| 130 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:27.863 AM | 589a9736de69e3dcfe612a50f85a338e3877262f | 3/9/2023, 8:37:33.819 PM | 5/2/2023, 12:37:26.308 AM | [ { "id": "41f13648dcad200b64b5ab8f8b7bc0632c7cd2dd", "name": "PelegGroup", "object": "identity", "email": null }, { "id": "fcb342027e211c7eaea85bcda8055f5d25178b8b", "name": "PelegGroup", "object": "account", "originId": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Change Management | [ "Defense Evasion", "Lateral Movement", "Persistence", "Privilege Escalation" ] | [ { "values": [ "6.2", "5.3" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "CC6.2", "CC6.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" } ] | [ "Account Manipulation", "Valid Accounts" ] | Open | Medium | 74705343919 | 74705343919 | Empty group with entitlements | 74701857016 | It is advisable to remove this group. | The group PelegGroup has no members but is entitled to one or more assets. | false | https://msftriskyuser.authomize.com/incidents/589a9736de69e3dcfe612a50f85a338e3877262f | Authomize_v2_CL | |||||||||||||||
| 131 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:27.863 AM | 4effb552e8d24929f868fd4518a32a0e80249a55 | 3/9/2023, 8:37:33.792 PM | 5/2/2023, 12:37:26.308 AM | [ { "id": "77f15a7387c0977e7b4f623285954c9f2a336e45", "name": "S3-access-group", "object": "identity", "email": null }, { "id": "1da3703abe10ecb5450a93b6de2adf8b91724a6e", "name": "S3-access-group", "object": "account", "originId": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Change Management | [ "Defense Evasion", "Lateral Movement", "Persistence", "Privilege Escalation" ] | [ { "values": [ "6.2", "5.3" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "CC6.2", "CC6.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" } ] | [ "Account Manipulation", "Valid Accounts" ] | Open | Medium | 74705343919 | 74705343919 | Empty group with entitlements | 74701857016 | It is advisable to remove this group. | The group S3-access-group has no members but is entitled to one or more assets. | false | https://msftriskyuser.authomize.com/incidents/4effb552e8d24929f868fd4518a32a0e80249a55 | Authomize_v2_CL | |||||||||||||||
| 132 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:29.219 AM | 529a981ac93404c349995ce2bea5c0e744424227 | 3/9/2023, 8:37:33.783 PM | 5/2/2023, 12:37:26.308 AM | [ { "id": "72a047470c3119eb49817ae92625df2f1c33e20d", "name": "API-Gateway-Admin", "object": "identity", "email": null }, { "id": "18a78d366d469104253a818daa0ee87eb4671a90", "name": "API-Gateway-Admin", "object": "account", "originId": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Change Management | [ "Defense Evasion", "Lateral Movement", "Persistence", "Privilege Escalation" ] | [ { "values": [ "6.2", "5.3" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "CC6.2", "CC6.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" } ] | [ "Account Manipulation", "Valid Accounts" ] | Open | Medium | 74705343919 | 74705343919 | Empty group with entitlements | 74701857016 | It is advisable to remove this group. | The group API-Gateway-Admin has no members but is entitled to one or more assets. | false | https://msftriskyuser.authomize.com/incidents/529a981ac93404c349995ce2bea5c0e744424227 | Authomize_v2_CL | |||||||||||||||
| 133 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:29.219 AM | 4461a118f15035fa7d39ed9c20b8b56ec283841e | 3/9/2023, 8:37:33.771 PM | 5/2/2023, 12:37:26.309 AM | [ { "id": "87d46203475a238adf9a16266785bf08a22cc119", "name": "Kubernetes", "object": "identity", "email": null }, { "id": "1bba9ba2a90ba24940f43b5b00de4470f5d7d3ae", "name": "Kubernetes", "object": "account", "originId": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Change Management | [ "Defense Evasion", "Lateral Movement", "Persistence", "Privilege Escalation" ] | [ { "values": [ "6.2", "5.3" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "CC6.2", "CC6.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" } ] | [ "Account Manipulation", "Valid Accounts" ] | Open | Medium | 74705343919 | 74705343919 | Empty group with entitlements | 74701857016 | It is advisable to remove this group. | The group Kubernetes has no members but is entitled to one or more assets. | false | https://msftriskyuser.authomize.com/incidents/4461a118f15035fa7d39ed9c20b8b56ec283841e | Authomize_v2_CL | |||||||||||||||
| 134 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:29.219 AM | 10f45b53c964cf7948c1f180237a77f87f39d737 | 3/9/2023, 8:37:33.755 PM | 5/2/2023, 12:37:26.310 AM | [ { "id": "0e50d37e5d3e9deda92d3888fa25f436bf807cd4", "name": "MiguelGroup", "object": "identity", "email": null }, { "id": "3345111b97cac86ad7252655bbc2421159a0ff80", "name": "MiguelGroup", "object": "account", "originId": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Change Management | [ "Defense Evasion", "Lateral Movement", "Persistence", "Privilege Escalation" ] | [ { "values": [ "6.2", "5.3" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "CC6.2", "CC6.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" } ] | [ "Account Manipulation", "Valid Accounts" ] | Open | Medium | 74705343919 | 74705343919 | Empty group with entitlements | 74701857016 | It is advisable to remove this group. | The group MiguelGroup has no members but is entitled to one or more assets. | false | https://msftriskyuser.authomize.com/incidents/10f45b53c964cf7948c1f180237a77f87f39d737 | Authomize_v2_CL | |||||||||||||||
| 135 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:29.219 AM | 01df956f2e2d38f722ac4ef6ba5e6e7145b8d2a9 | 3/9/2023, 8:37:33.743 PM | 5/2/2023, 12:37:26.310 AM | [ { "id": "b7c920b90dab66c7c388120ee0be69e876813631", "name": "aa", "object": "identity", "email": null }, { "id": "3deb73cdd33933de3fa787665d2d9cccc583b517", "name": "aa", "object": "account", "originId": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Change Management | [ "Defense Evasion", "Lateral Movement", "Persistence", "Privilege Escalation" ] | [ { "values": [ "6.2", "5.3" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "CC6.2", "CC6.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" } ] | [ "Account Manipulation", "Valid Accounts" ] | Open | Medium | 74705343919 | 74705343919 | Empty group with entitlements | 74701857016 | It is advisable to remove this group. | The group aa has no members but is entitled to one or more assets. | false | https://msftriskyuser.authomize.com/incidents/01df956f2e2d38f722ac4ef6ba5e6e7145b8d2a9 | Authomize_v2_CL | |||||||||||||||
| 136 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:29.219 AM | d7782412e5e85bb6ed69cc04e0274d5e33557e58 | 3/9/2023, 8:37:33.735 PM | 5/2/2023, 12:37:26.308 AM | [ { "id": "b9ff66d657cf3ba2b84158d4e4a51da0a18f41fb", "name": "Administrators", "object": "identity", "email": null }, { "id": "d72d8d4f29c01dd06629f3bcd1884568fc458a0e", "name": "Administrators", "object": "account", "originId": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Change Management | [ "Defense Evasion", "Lateral Movement", "Persistence", "Privilege Escalation" ] | [ { "values": [ "6.2", "5.3" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "CC6.2", "CC6.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" } ] | [ "Account Manipulation", "Valid Accounts" ] | Open | Medium | 74705343919 | 74705343919 | Empty group with entitlements | 74701857016 | It is advisable to remove this group. | The group Administrators has no members but is entitled to one or more assets. | false | https://msftriskyuser.authomize.com/incidents/d7782412e5e85bb6ed69cc04e0274d5e33557e58 | Authomize_v2_CL | |||||||||||||||
| 137 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:29.219 AM | ca796ace81cf6e98a92dc2ab9d893fb8dc609c41 | 3/9/2023, 8:37:33.705 PM | 5/2/2023, 12:37:26.310 AM | [ { "id": "b96acf540fd0e5edddc04f123062af708dd9e237", "name": "AWS_lambda_full_access", "object": "identity", "email": null }, { "id": "486a5a6c52589129ba05b56168bae8cbe522e0f3", "name": "AWS_lambda_full_access", "object": "account", "originId": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Change Management | [ "Defense Evasion", "Lateral Movement", "Persistence", "Privilege Escalation" ] | [ { "values": [ "6.2", "5.3" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "CC6.2", "CC6.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" } ] | [ "Account Manipulation", "Valid Accounts" ] | Open | Medium | 74705343919 | 74705343919 | Empty group with entitlements | 74701857016 | It is advisable to remove this group. | The group AWS_lambda_full_access has no members but is entitled to one or more assets. | false | https://msftriskyuser.authomize.com/incidents/ca796ace81cf6e98a92dc2ab9d893fb8dc609c41 | Authomize_v2_CL | |||||||||||||||
| 138 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:29.219 AM | e025d3f5ff4eef4ff3457b79b3e0f11c917ebd53 | 3/7/2023, 11:39:44.598 PM | 5/2/2023, 12:41:36.809 AM | [ { "id": "319d63d56065543badcc8a611ec8c435caa373b0", "name": "Okta__ec2_lambda_s3_full", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "IAM-10" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" } ] | [] | Open | High | 91723199050 | 91723199050 | AWS role with shadow admin privileges | 88391696752 | Validate any new role creation and make sure it's part of the business cycle. If needed access the AWS console and remove the role. | AWS Shadow Admin Identity role Okta__ec2_lambda_s3_full was created in AWS. | false | https://msftriskyuser.authomize.com/incidents/e025d3f5ff4eef4ff3457b79b3e0f11c917ebd53 | Authomize_v2_CL | |||||||||||||||
| 139 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:29.219 AM | 7e5af697a824cdda2aad6c282b701c44b7fcdbc3 | 3/7/2023, 11:39:44.592 PM | 5/2/2023, 12:41:36.809 AM | [ { "id": "db72c19c40a4c44a25d56824e4490b2e40a71f7d", "name": "empty_role_allow_assume", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "IAM-10" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" } ] | [] | Open | High | 91723199050 | 91723199050 | AWS role with shadow admin privileges | 88391696752 | Validate any new role creation and make sure it's part of the business cycle. If needed access the AWS console and remove the role. | AWS Shadow Admin Identity role empty_role_allow_assume was created in AWS. | false | https://msftriskyuser.authomize.com/incidents/7e5af697a824cdda2aad6c282b701c44b7fcdbc3 | Authomize_v2_CL | |||||||||||||||
| 140 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:29.219 AM | dd580bf77bb516aa04f80ae8a5d42bdcb05d6d89 | 3/7/2023, 11:39:44.585 PM | 5/2/2023, 12:41:36.810 AM | [ { "id": "3e7da1d00f61d0c5a5afb707e267082d8137a2b8", "name": "attach-role-to-user-role", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "IAM-10" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" } ] | [] | Open | High | 91723199050 | 91723199050 | AWS role with shadow admin privileges | 88391696752 | Validate any new role creation and make sure it's part of the business cycle. If needed access the AWS console and remove the role. | AWS Shadow Admin Identity role attach-role-to-user-role was created in AWS. | false | https://msftriskyuser.authomize.com/incidents/dd580bf77bb516aa04f80ae8a5d42bdcb05d6d89 | Authomize_v2_CL | |||||||||||||||
| 141 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:29.219 AM | c7de1501c76d2830719fdb60ce88672a386eb449 | 3/7/2023, 11:39:44.578 PM | 5/2/2023, 12:41:36.810 AM | [ { "id": "f7a97b83c333f46af3b8b0ae91edc1de7ec96f7e", "name": "privesc1-CreateNewPolicyVersion-role", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "IAM-10" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" } ] | [] | Open | High | 91723199050 | 91723199050 | AWS role with shadow admin privileges | 88391696752 | Validate any new role creation and make sure it's part of the business cycle. If needed access the AWS console and remove the role. | AWS Shadow Admin Identity role privesc1-CreateNewPolicyVersion-role was created in AWS. | false | https://msftriskyuser.authomize.com/incidents/c7de1501c76d2830719fdb60ce88672a386eb449 | Authomize_v2_CL | |||||||||||||||
| 142 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:30.480 AM | 86e636842daa2eb7e75f8b5a0ed5ce781c638cfc | 3/7/2023, 11:39:44.570 PM | 5/2/2023, 12:41:36.809 AM | [ { "id": "5c6c09e4e4d31639d6371c52a27cde555b1d9f86", "name": "ping_idp_role", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "IAM-10" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" } ] | [] | Open | High | 91723199050 | 91723199050 | AWS role with shadow admin privileges | 88391696752 | Validate any new role creation and make sure it's part of the business cycle. If needed access the AWS console and remove the role. | AWS Shadow Admin Identity role ping_idp_role was created in AWS. | false | https://msftriskyuser.authomize.com/incidents/86e636842daa2eb7e75f8b5a0ed5ce781c638cfc | Authomize_v2_CL | |||||||||||||||
| 143 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:30.480 AM | a632484c12bd1e928cc78aab9786c1189ea186a5 | 3/7/2023, 11:39:44.562 PM | 5/2/2023, 12:41:36.810 AM | [ { "id": "d507eaddc1b75bdc9a8767a2df19c20a88481fcc", "name": "ec2_lambda_access", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "IAM-10" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" } ] | [] | Open | High | 91723199050 | 91723199050 | AWS role with shadow admin privileges | 88391696752 | Validate any new role creation and make sure it's part of the business cycle. If needed access the AWS console and remove the role. | AWS Shadow Admin Identity role ec2_lambda_access was created in AWS. | false | https://msftriskyuser.authomize.com/incidents/a632484c12bd1e928cc78aab9786c1189ea186a5 | Authomize_v2_CL | |||||||||||||||
| 144 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:30.480 AM | 94321327291656879821fa4682c62169047e3265 | 3/7/2023, 11:39:44.555 PM | 5/2/2023, 12:41:36.810 AM | [ { "id": "7a43f5c11380d1dd190b7458993e7bf01450ed55", "name": "ec2_lambda_s3_full", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "IAM-10" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" } ] | [] | Open | High | 91723199050 | 91723199050 | AWS role with shadow admin privileges | 88391696752 | Validate any new role creation and make sure it's part of the business cycle. If needed access the AWS console and remove the role. | AWS Shadow Admin Identity role ec2_lambda_s3_full was created in AWS. | false | https://msftriskyuser.authomize.com/incidents/94321327291656879821fa4682c62169047e3265 | Authomize_v2_CL | |||||||||||||||
| 145 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:30.480 AM | d9f756b15717c0f721b3d6bc4a769dab9dbf3a28 | 3/7/2023, 11:39:40.905 PM | 5/2/2023, 12:41:51.337 AM | [ { "id": "7ab18be02ddd9457aae27ae70625a078242de94e", "name": "privesc-AssumeRole-ending-role", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "IAM-10" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" } ] | [] | Open | High | 91723198479 | 91723198479 | AWS role with admin privileges | 88391696752 | Validate any new role creation and make sure it's part of the business cycle. If needed access the AWS console and remove the role. | AWS Admin Identity role privesc-AssumeRole-ending-role was created in AWS. | false | https://msftriskyuser.authomize.com/incidents/d9f756b15717c0f721b3d6bc4a769dab9dbf3a28 | Authomize_v2_CL | |||||||||||||||
| 146 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:30.480 AM | 5c10577815b0691960e98f9d15a35e2fa33f91a5 | 3/7/2023, 11:39:40.899 PM | 5/2/2023, 12:41:51.338 AM | [ { "id": "a80fdf41855aaa5aaf374a5c816f3fc33357a600", "name": "AWSControlTowerExecution", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "IAM-10" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" } ] | [] | Open | High | 91723198479 | 91723198479 | AWS role with admin privileges | 88391696752 | Validate any new role creation and make sure it's part of the business cycle. If needed access the AWS console and remove the role. | AWS Admin Identity role AWSControlTowerExecution was created in AWS. | false | https://msftriskyuser.authomize.com/incidents/5c10577815b0691960e98f9d15a35e2fa33f91a5 | Authomize_v2_CL | |||||||||||||||
| 147 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:30.480 AM | 77eb5c78844d2c36acf101a77f88e45c3a68fc73 | 3/7/2023, 11:39:40.892 PM | 5/2/2023, 12:41:51.338 AM | [ { "id": "7f018469507d78e633a502dd29993b1787d6ad5a", "name": "AuthomizeAdministrator", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "IAM-10" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" } ] | [] | Open | High | 91723198479 | 91723198479 | AWS role with admin privileges | 88391696752 | Validate any new role creation and make sure it's part of the business cycle. If needed access the AWS console and remove the role. | AWS Admin Identity role AuthomizeAdministrator was created in AWS. | false | https://msftriskyuser.authomize.com/incidents/77eb5c78844d2c36acf101a77f88e45c3a68fc73 | Authomize_v2_CL | |||||||||||||||
| 148 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:30.480 AM | 04d7db2d9cf2a47f9a078d755255b0f3b5aed3e1 | 3/7/2023, 11:39:40.871 PM | 5/2/2023, 12:41:51.338 AM | [ { "id": "aab32332006d7360590a4dfab80ca51894311471", "name": "site-reliability-engineering-role", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "IAM-10" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" } ] | [] | Open | High | 91723198479 | 91723198479 | AWS role with admin privileges | 88391696752 | Validate any new role creation and make sure it's part of the business cycle. If needed access the AWS console and remove the role. | AWS Admin Identity role site-reliability-engineering-role was created in AWS. | false | https://msftriskyuser.authomize.com/incidents/04d7db2d9cf2a47f9a078d755255b0f3b5aed3e1 | Authomize_v2_CL | |||||||||||||||
| 149 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:30.480 AM | a25c70b587a9f7429c6610113bfc94cecad8d25e | 3/7/2023, 11:39:40.865 PM | 5/2/2023, 12:41:51.337 AM | [ { "id": "b8e0bbe3f7f97a34821108a6b1d2f2cba6ad5607", "name": "OrganizationAccountAccessRole", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "IAM-10" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" } ] | [] | Open | High | 91723198479 | 91723198479 | AWS role with admin privileges | 88391696752 | Validate any new role creation and make sure it's part of the business cycle. If needed access the AWS console and remove the role. | AWS Admin Identity role OrganizationAccountAccessRole was created in AWS. | false | https://msftriskyuser.authomize.com/incidents/a25c70b587a9f7429c6610113bfc94cecad8d25e | Authomize_v2_CL | |||||||||||||||
| 150 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:30.480 AM | b9320f38ec60b4231453ce4408c8d89859454cbd | 3/7/2023, 11:39:40.859 PM | 5/2/2023, 12:41:51.339 AM | [ { "id": "419a36f4a31c6e3a28f7ff4c83ffe4e64ec82145", "name": "privesc-high-priv-service-role", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "IAM-10" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" } ] | [] | Open | High | 91723198479 | 91723198479 | AWS role with admin privileges | 88391696752 | Validate any new role creation and make sure it's part of the business cycle. If needed access the AWS console and remove the role. | AWS Admin Identity role privesc-high-priv-service-role was created in AWS. | false | https://msftriskyuser.authomize.com/incidents/b9320f38ec60b4231453ce4408c8d89859454cbd | Authomize_v2_CL | |||||||||||||||
| 151 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:30.480 AM | 04467cb53d96c954ec8f6e657f96841683b0086e | 3/7/2023, 11:39:40.852 PM | 5/2/2023, 12:41:51.337 AM | [ { "id": "b87a3769c0646fbf60607c77a0c8ebf7afe204e2", "name": "manage_iam", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "IAM-10" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" } ] | [] | Open | High | 91723198479 | 91723198479 | AWS role with admin privileges | 88391696752 | Validate any new role creation and make sure it's part of the business cycle. If needed access the AWS console and remove the role. | AWS Admin Identity role manage_iam was created in AWS. | false | https://msftriskyuser.authomize.com/incidents/04467cb53d96c954ec8f6e657f96841683b0086e | Authomize_v2_CL | |||||||||||||||
| 152 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:33.513 AM | 5e567952bc02c72b464d71803aaedfc3eb32eda7 | 3/6/2023, 11:40:39.642 PM | 5/2/2023, 12:41:21.559 AM | [ { "id": "7d29c7098089bb98af2c51a3e21f1ed7ac4ef1be", "name": "AmazonSSMManagedInstanceCore", "object": "asset", "originId": null, "originType": "PolicyResource" }, { "id": "419a36f4a31c6e3a28f7ff4c83ffe4e64ec82145", "name": "privesc-high-priv-service-role", "object": "identity", "email": null }, { "id": "d82020eb55aec9894fa6ca08435c95833972182c", "name": "privesc-high-priv-service-role", "object": "account", "originId": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Least Privilege | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723196731 | 91723196731 | Stale IAAS policy attachment to role | 88391681312 | Unused policies should be detached from privesc-high-priv-service-role | privesc-high-priv-service-role hasn't used the Policy AmazonSSMManagedInstanceCore during the past 30 days. | false | https://msftriskyuser.authomize.com/incidents/5e567952bc02c72b464d71803aaedfc3eb32eda7 | Authomize_v2_CL | |||||||||||||||
| 153 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:33.513 AM | dc410b38351fc34763632a0f06bc8c71b61a681b | 3/6/2023, 11:40:34.602 PM | 5/2/2023, 12:41:20.129 AM | [ { "id": "289913f8294a9a91eea3c09925c324e2634c6e04", "name": "privesc1-CreateNewPolicyVersion", "object": "asset", "originId": null, "originType": "PolicyResource" }, { "id": "bf2be9d8713021d095f0f043f73a9234ca5ed1cc", "name": "manage-policies", "object": "identity", "email": null }, { "id": "e6e32bbaf67cca161b0a1e605f9bed3abad4de5c", "name": "manage-policies", "object": "account", "originId": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Least Privilege | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723195983 | 91723195983 | Stale AWS policy attachment to identity | 88391681312 | Unused policies should be detached from manage-policies | manage-policies hasn't used the Policy privesc1-CreateNewPolicyVersion during the past 30 days. | false | https://msftriskyuser.authomize.com/incidents/dc410b38351fc34763632a0f06bc8c71b61a681b | Authomize_v2_CL | |||||||||||||||
| 154 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:33.513 AM | a50a03fe9a94c5b09d00360eee9bca9ab6e9ce65 | 3/6/2023, 11:40:34.595 PM | 5/2/2023, 12:41:20.128 AM | [ { "id": "17e6cc88313de9b78e9c9294f61fef08f9e4500f", "name": "IAMlistRolesAccounts", "object": "asset", "originId": null, "originType": "PolicyResource" }, { "id": "725737663b035a749c31dd80746bf014d1847f00", "name": "OktaSSOuser", "object": "identity", "email": null }, { "id": "0d3e83d83fccaa6ffd8546123f0865497b73cccf", "name": "OktaSSOuser", "object": "account", "originId": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Least Privilege | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723195983 | 91723195983 | Stale AWS policy attachment to identity | 88391681312 | Unused policies should be detached from OktaSSOuser | OktaSSOuser hasn't used the Policy IAMlistRolesAccounts during the past 30 days. | false | https://msftriskyuser.authomize.com/incidents/a50a03fe9a94c5b09d00360eee9bca9ab6e9ce65 | Authomize_v2_CL | |||||||||||||||
| 155 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:33.513 AM | d74e154cbcd267863ad5c48362c4dce8914386e6 | 3/6/2023, 11:40:34.585 PM | 5/2/2023, 12:41:20.128 AM | [ { "id": "bb786de8906e3dfad445d7d07466796ebb50eb1b", "name": "privesc15-PassExistingRoleToNewLambdaThenInvoke", "object": "asset", "originId": null, "originType": "PolicyResource" }, { "id": "2cee0622e84e4f94a1f24fc77499544568f77d30", "name": "lambda-func-support", "object": "identity", "email": null }, { "id": "fe16ab49a795d70edacfdf439cc0752db26edd6a", "name": "lambda-func-support", "object": "account", "originId": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Least Privilege | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723195983 | 91723195983 | Stale AWS policy attachment to identity | 88391681312 | Unused policies should be detached from lambda-func-support | lambda-func-support hasn't used the Policy privesc15-PassExistingRoleToNewLambdaThenInvoke during the past 30 days. | false | https://msftriskyuser.authomize.com/incidents/d74e154cbcd267863ad5c48362c4dce8914386e6 | Authomize_v2_CL | |||||||||||||||
| 156 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:33.513 AM | abb89329fbbeef5eba3fd18ef8b73ed5f09b3b52 | 3/6/2023, 11:40:29.755 PM | 5/2/2023, 12:41:18.459 AM | [ { "id": "a2759a42abaeff2c8d666658ff7d13841150277d", "name": "mount_secret_job_policy", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Least Privilege | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 91723195066 | 91723195066 | Unused IaaS Policy | 88391682078 | Go to AWS console, access account 291883359082, or the way you manage user assignment to rolesRemove the policy mount_secret_job_policy completely or remove if from any identity that has access to it (the list can be found in our identity page) | The policy mount_secret_job_policy haven't been used during the last 30 days in account 291883359082, the policy is attached to 1 identities | false | https://msftriskyuser.authomize.com/incidents/abb89329fbbeef5eba3fd18ef8b73ed5f09b3b52 | Authomize_v2_CL | |||||||||||||||
| 157 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:33.513 AM | 68571dfba620fc70c325fa20d3cb45ae8c51d171 | 3/6/2023, 11:40:29.745 PM | 5/2/2023, 12:41:18.460 AM | [ { "id": "dc007a611e29f71988e312d277c9f8f7eb3e503d", "name": "csi_driver_policy", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Least Privilege | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 91723195066 | 91723195066 | Unused IaaS Policy | 88391682078 | Go to AWS console, access account 291883359082, or the way you manage user assignment to rolesRemove the policy csi_driver_policy completely or remove if from any identity that has access to it (the list can be found in our identity page) | The policy csi_driver_policy haven't been used during the last 30 days in account 291883359082, the policy is attached to 1 identities | false | https://msftriskyuser.authomize.com/incidents/68571dfba620fc70c325fa20d3cb45ae8c51d171 | Authomize_v2_CL | |||||||||||||||
| 158 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:33.513 AM | fd8112a800b184a03e961f25bb5f70a6e1455e70 | 3/6/2023, 11:40:29.739 PM | 5/2/2023, 12:41:18.460 AM | [ { "id": "7b79a12d8ee42b00f12725c3fc67fe3f4d865eda", "name": "argocd-policy", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Least Privilege | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 91723195066 | 91723195066 | Unused IaaS Policy | 88391682078 | Go to AWS console, access account 291883359082, or the way you manage user assignment to rolesRemove the policy argocd-policy completely or remove if from any identity that has access to it (the list can be found in our identity page) | The policy argocd-policy haven't been used during the last 30 days in account 291883359082, the policy is attached to 1 identities | false | https://msftriskyuser.authomize.com/incidents/fd8112a800b184a03e961f25bb5f70a6e1455e70 | Authomize_v2_CL | |||||||||||||||
| 159 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:33.513 AM | 0b40d230b1663617734e45f8a9e02c919ee8b3eb | 3/6/2023, 11:40:29.733 PM | 5/2/2023, 12:41:18.459 AM | [ { "id": "f857df2d21bfff1a3eaeff0e5ee21a8948a7ad0e", "name": "jumpbox_policy", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Least Privilege | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 91723195066 | 91723195066 | Unused IaaS Policy | 88391682078 | Go to AWS console, access account 291883359082, or the way you manage user assignment to rolesRemove the policy jumpbox_policy completely or remove if from any identity that has access to it (the list can be found in our identity page) | The policy jumpbox_policy haven't been used during the last 30 days in account 291883359082, the policy is attached to 1 identities | false | https://msftriskyuser.authomize.com/incidents/0b40d230b1663617734e45f8a9e02c919ee8b3eb | Authomize_v2_CL | |||||||||||||||
| 160 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:33.513 AM | 14810114f8e8608a02f3e566a1ecac0d25d892cf | 3/6/2023, 11:40:29.723 PM | 5/2/2023, 12:41:18.458 AM | [ { "id": "4dd4b0d1c39a1a934bcc5026368d7f187e9f43db", "name": "authomize-jenkins-policy", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Least Privilege | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 91723195066 | 91723195066 | Unused IaaS Policy | 88391682078 | Go to AWS console, access account 291883359082, or the way you manage user assignment to rolesRemove the policy authomize-jenkins-policy completely or remove if from any identity that has access to it (the list can be found in our identity page) | The policy authomize-jenkins-policy haven't been used during the last 30 days in account 291883359082, the policy is attached to 1 identities | false | https://msftriskyuser.authomize.com/incidents/14810114f8e8608a02f3e566a1ecac0d25d892cf | Authomize_v2_CL | |||||||||||||||
| 161 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:33.513 AM | 7c392962781c5a949421a81783ed1923b4573358 | 3/6/2023, 11:40:29.707 PM | 5/2/2023, 12:41:18.460 AM | [ { "id": "f0e2e3faf45f5a71b75d78d6f153fd2fa30dc032", "name": "monitoring_policy", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Least Privilege | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 91723195066 | 91723195066 | Unused IaaS Policy | 88391682078 | Go to AWS console, access account 291883359082, or the way you manage user assignment to rolesRemove the policy monitoring_policy completely or remove if from any identity that has access to it (the list can be found in our identity page) | The policy monitoring_policy haven't been used during the last 30 days in account 291883359082, the policy is attached to 1 identities | false | https://msftriskyuser.authomize.com/incidents/7c392962781c5a949421a81783ed1923b4573358 | Authomize_v2_CL | |||||||||||||||
| 162 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:35.071 AM | 10027b10a6c6a488f647c21cdb27e9bbf92ba45d | 3/6/2023, 11:40:29.699 PM | 5/2/2023, 12:41:18.459 AM | [ { "id": "17e6cc88313de9b78e9c9294f61fef08f9e4500f", "name": "IAMlistRolesAccounts", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Least Privilege | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 91723195066 | 91723195066 | Unused IaaS Policy | 88391682078 | Go to AWS console, access account 071186405907, or the way you manage user assignment to rolesRemove the policy IAMlistRolesAccounts completely or remove if from any identity that has access to it (the list can be found in our identity page) | The policy IAMlistRolesAccounts haven't been used during the last 30 days in account 071186405907, the policy is attached to 1 identities | false | https://msftriskyuser.authomize.com/incidents/10027b10a6c6a488f647c21cdb27e9bbf92ba45d | Authomize_v2_CL | |||||||||||||||
| 163 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:35.071 AM | 427a6fcfcfa599854e5336ca8dc8278c4e00f3a4 | 3/6/2023, 11:40:29.678 PM | 5/2/2023, 12:41:18.459 AM | [ { "id": "12e9434dbaf78fc54f667d6ceb570a95a9b0a463", "name": "allow-pass-role", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Least Privilege | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 91723195066 | 91723195066 | Unused IaaS Policy | 88391682078 | Go to AWS console, access account 071186405907, or the way you manage user assignment to rolesRemove the policy allow-pass-role completely or remove if from any identity that has access to it (the list can be found in our identity page) | The policy allow-pass-role haven't been used during the last 30 days in account 071186405907, the policy is attached to 3 identities | false | https://msftriskyuser.authomize.com/incidents/427a6fcfcfa599854e5336ca8dc8278c4e00f3a4 | Authomize_v2_CL | |||||||||||||||
| 164 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:35.071 AM | a42ea750e8b225e28b5c52230a2f6e58804024ca | 3/6/2023, 11:40:29.671 PM | 5/2/2023, 12:41:18.459 AM | [ { "id": "289913f8294a9a91eea3c09925c324e2634c6e04", "name": "privesc1-CreateNewPolicyVersion", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Least Privilege | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 91723195066 | 91723195066 | Unused IaaS Policy | 88391682078 | Go to AWS console, access account 071186405907, or the way you manage user assignment to rolesRemove the policy privesc1-CreateNewPolicyVersion completely or remove if from any identity that has access to it (the list can be found in our identity page) | The policy privesc1-CreateNewPolicyVersion haven't been used during the last 30 days in account 071186405907, the policy is attached to 2 identities | false | https://msftriskyuser.authomize.com/incidents/a42ea750e8b225e28b5c52230a2f6e58804024ca | Authomize_v2_CL | |||||||||||||||
| 165 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:35.071 AM | f80a685fd0b1c52f7eb7bb8974a524a1ca7204a1 | 3/6/2023, 11:40:29.665 PM | 5/2/2023, 12:41:18.459 AM | [ { "id": "7bf141d4c7d9e848e4bbe7221618117dbc4ffcfc", "name": "privesc-high-priv-service-policy", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Least Privilege | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 91723195066 | 91723195066 | Unused IaaS Policy | 88391682078 | Go to AWS console, access account 071186405907, or the way you manage user assignment to rolesRemove the policy privesc-high-priv-service-policy completely or remove if from any identity that has access to it (the list can be found in our identity page) | The policy privesc-high-priv-service-policy haven't been used during the last 30 days in account 071186405907, the policy is attached to 1 identities | false | https://msftriskyuser.authomize.com/incidents/f80a685fd0b1c52f7eb7bb8974a524a1ca7204a1 | Authomize_v2_CL | |||||||||||||||
| 166 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:35.071 AM | 7087ca929b842f036820fe6c93ac9342407627bc | 3/6/2023, 11:40:29.659 PM | 5/2/2023, 12:41:18.460 AM | [ { "id": "c7a0ad09d8e61ea968d3562c459965a4f147adef", "name": "admin-priv", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Least Privilege | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 91723195066 | 91723195066 | Unused IaaS Policy | 88391682078 | Go to AWS console, access account 071186405907, or the way you manage user assignment to rolesRemove the policy admin-priv completely or remove if from any identity that has access to it (the list can be found in our identity page) | The policy admin-priv haven't been used during the last 30 days in account 071186405907, the policy is attached to 1 identities | false | https://msftriskyuser.authomize.com/incidents/7087ca929b842f036820fe6c93ac9342407627bc | Authomize_v2_CL | |||||||||||||||
| 167 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:35.071 AM | 8f15c98763f6efe465ec4b0790814b598464a7a1 | 3/6/2023, 11:40:29.619 PM | 5/2/2023, 12:41:18.459 AM | [ { "id": "bb786de8906e3dfad445d7d07466796ebb50eb1b", "name": "privesc15-PassExistingRoleToNewLambdaThenInvoke", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Least Privilege | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 91723195066 | 91723195066 | Unused IaaS Policy | 88391682078 | Go to AWS console, access account 071186405907, or the way you manage user assignment to rolesRemove the policy privesc15-PassExistingRoleToNewLambdaThenInvoke completely or remove if from any identity that has access to it (the list can be found in our identity page) | The policy privesc15-PassExistingRoleToNewLambdaThenInvoke haven't been used during the last 30 days in account 071186405907, the policy is attached to 2 identities | false | https://msftriskyuser.authomize.com/incidents/8f15c98763f6efe465ec4b0790814b598464a7a1 | Authomize_v2_CL | |||||||||||||||
| 168 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:35.071 AM | 95d68246ee41bc2f303c9278f6091e61a5890993 | 3/6/2023, 11:40:29.609 PM | 5/2/2023, 12:41:18.458 AM | [ { "id": "2637e1d6674209b04deb80fc8ebac67bd02f024b", "name": "assume-admin-role", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Least Privilege | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 91723195066 | 91723195066 | Unused IaaS Policy | 88391682078 | Go to AWS console, access account 071186405907, or the way you manage user assignment to rolesRemove the policy assume-admin-role completely or remove if from any identity that has access to it (the list can be found in our identity page) | The policy assume-admin-role haven't been used during the last 30 days in account 071186405907, the policy is attached to 1 identities | false | https://msftriskyuser.authomize.com/incidents/95d68246ee41bc2f303c9278f6091e61a5890993 | Authomize_v2_CL | |||||||||||||||
| 169 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:35.071 AM | a6e4d322b22418afdf2698d9af7c6f91df10def5 | 3/6/2023, 11:40:29.603 PM | 5/2/2023, 12:41:18.459 AM | [ { "id": "04c8b99fc389ce9a429a970f5adb9df182199431", "name": "iam_admin", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Least Privilege | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 91723195066 | 91723195066 | Unused IaaS Policy | 88391682078 | Go to AWS console, access account 071186405907, or the way you manage user assignment to rolesRemove the policy iam_admin completely or remove if from any identity that has access to it (the list can be found in our identity page) | The policy iam_admin haven't been used during the last 30 days in account 071186405907, the policy is attached to 2 identities | false | https://msftriskyuser.authomize.com/incidents/a6e4d322b22418afdf2698d9af7c6f91df10def5 | Authomize_v2_CL | |||||||||||||||
| 170 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:35.071 AM | 81b1f79ad612a8472d45aaa0e360aefff2c36aca | 3/6/2023, 11:40:29.587 PM | 5/2/2023, 12:41:18.459 AM | [ { "id": "844a59bcacd070e3e47759024aca96b5d6f05353", "name": "site-reliability-engineering", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Least Privilege | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 91723195066 | 91723195066 | Unused IaaS Policy | 88391682078 | Go to AWS console, access account 071186405907, or the way you manage user assignment to rolesRemove the policy site-reliability-engineering completely or remove if from any identity that has access to it (the list can be found in our identity page) | The policy site-reliability-engineering haven't been used during the last 30 days in account 071186405907, the policy is attached to 2 identities | false | https://msftriskyuser.authomize.com/incidents/81b1f79ad612a8472d45aaa0e360aefff2c36aca | Authomize_v2_CL | |||||||||||||||
| 171 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:35.071 AM | 7957dba40309d9c6f1d6337d1df0c916fbfe5cb7 | 3/6/2023, 11:40:29.575 PM | 5/2/2023, 12:41:18.460 AM | [ { "id": "05096bd26f6118e7f0b93bfd37a9a955d1197518", "name": "run-ec2-instances", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Least Privilege | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 91723195066 | 91723195066 | Unused IaaS Policy | 88391682078 | Go to AWS console, access account 071186405907, or the way you manage user assignment to rolesRemove the policy run-ec2-instances completely or remove if from any identity that has access to it (the list can be found in our identity page) | The policy run-ec2-instances haven't been used during the last 30 days in account 071186405907, the policy is attached to 2 identities | false | https://msftriskyuser.authomize.com/incidents/7957dba40309d9c6f1d6337d1df0c916fbfe5cb7 | Authomize_v2_CL | |||||||||||||||
| 172 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:35.767 AM | 31268b0969aff0de03825871a5d33902c5bed1e3 | 3/6/2023, 11:40:29.564 PM | 5/2/2023, 12:41:18.458 AM | [ { "id": "1416aeae90186286c0c23cfe54331f3e6db256ee", "name": "trust_policy_for_empty_assume_role", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Least Privilege | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 91723195066 | 91723195066 | Unused IaaS Policy | 88391682078 | Go to AWS console, access account 071186405907, or the way you manage user assignment to rolesRemove the policy trust_policy_for_empty_assume_role completely or remove if from any identity that has access to it (the list can be found in our identity page) | The policy trust_policy_for_empty_assume_role haven't been used during the last 30 days in account 071186405907, the policy is attached to 1 identities | false | https://msftriskyuser.authomize.com/incidents/31268b0969aff0de03825871a5d33902c5bed1e3 | Authomize_v2_CL | |||||||||||||||
| 173 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:35.767 AM | 91f881e8588cbb26f5c35273585f50e3360b5f13 | 3/6/2023, 11:40:24.772 PM | 5/2/2023, 12:41:10.566 AM | [ { "id": "94e6fb9f06d851fca4a6342c3eaec0cce38a4806", "name": "AssumeAnyRole", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy AssumeAnyRole is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/91f881e8588cbb26f5c35273585f50e3360b5f13 | Authomize_v2_CL | |||||||||||||||
| 174 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:35.767 AM | 6ab791930df659941d858066e725767b116bc714 | 3/6/2023, 11:40:24.763 PM | 5/2/2023, 12:41:10.565 AM | [ { "id": "2fb0de8b8bf6a2b98ac7073a075342218f4e6fee", "name": "assume_role_user_lister", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy assume_role_user_lister is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/6ab791930df659941d858066e725767b116bc714 | Authomize_v2_CL | |||||||||||||||
| 175 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:35.767 AM | 9630fdd50e89cf0093d56b93aa3778733c048c00 | 3/6/2023, 11:40:24.753 PM | 5/2/2023, 12:41:10.565 AM | [ { "id": "7e55583466701f3f1b8bcf23aeb025424796243f", "name": "SingleRoleAssue", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy SingleRoleAssue is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/9630fdd50e89cf0093d56b93aa3778733c048c00 | Authomize_v2_CL | |||||||||||||||
| 176 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:35.767 AM | 774018ea25a934ff992ce10dab37dafae89101fb | 3/6/2023, 11:40:24.744 PM | 5/2/2023, 12:41:10.565 AM | [ { "id": "3e68b64bfd2ba8d7205e3361d598b23692776f30", "name": "limitfiverr", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy limitfiverr is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/774018ea25a934ff992ce10dab37dafae89101fb | Authomize_v2_CL | |||||||||||||||
| 177 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:35.767 AM | 0391d52c0b5b993cc69c7fa59f71b0131aa69c61 | 3/6/2023, 11:40:24.734 PM | 5/2/2023, 12:41:10.566 AM | [ { "id": "a6359d5ca9e4a97c361719f49d7db9add722f71c", "name": "ram_list_resources", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy ram_list_resources is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/0391d52c0b5b993cc69c7fa59f71b0131aa69c61 | Authomize_v2_CL | |||||||||||||||
| 178 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:35.767 AM | 10bb250af6005cd1bcca5eda0fc1bdb81596027a | 3/6/2023, 11:40:24.727 PM | 5/2/2023, 12:41:10.565 AM | [ { "id": "e6987336220dd33584ff7475bee1ab54e34e0184", "name": "OktaMasterAccountPolicy", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy OktaMasterAccountPolicy is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/10bb250af6005cd1bcca5eda0fc1bdb81596027a | Authomize_v2_CL | |||||||||||||||
| 179 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:35.767 AM | 108c2df128bce4109708f77b885cdc4ebd54e401 | 3/6/2023, 11:40:24.715 PM | 5/2/2023, 12:41:10.566 AM | [ { "id": "631d5fc888b97043e825b91514f683ed2c249e77", "name": "EXP", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy EXP is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/108c2df128bce4109708f77b885cdc4ebd54e401 | Authomize_v2_CL | |||||||||||||||
| 180 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:35.767 AM | 4bbc8ef8c44b5358a762ada0151ec38f4ff6e673 | 3/6/2023, 11:40:24.706 PM | 5/2/2023, 12:41:10.566 AM | [ { "id": "3962e254167271d2277e30be117a31d594c477e0", "name": "UserPolicyAttacher", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy UserPolicyAttacher is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/4bbc8ef8c44b5358a762ada0151ec38f4ff6e673 | Authomize_v2_CL | |||||||||||||||
| 181 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:35.767 AM | 8a2007628804a462c44246b0122fba5940969e20 | 3/6/2023, 11:40:24.695 PM | 5/2/2023, 12:41:10.566 AM | [ { "id": "4945f361807cd1c186d79cadc9de41033e2e5499", "name": "NamedGroupPermissionManager", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy NamedGroupPermissionManager is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/8a2007628804a462c44246b0122fba5940969e20 | Authomize_v2_CL | |||||||||||||||
| 182 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:37.071 AM | 6a7f0c02d7c939392b6df6b8a4ebd93da035914d | 3/6/2023, 11:40:24.679 PM | 5/2/2023, 12:41:10.566 AM | [ { "id": "a77c75c59ab5018635f4ddfb19d88d22cbb89f3b", "name": "assume_all_roles", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy assume_all_roles is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/6a7f0c02d7c939392b6df6b8a4ebd93da035914d | Authomize_v2_CL | |||||||||||||||
| 183 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:37.071 AM | ecfe31419d4532cc756383c3596763616f700641 | 3/6/2023, 11:40:24.669 PM | 5/2/2023, 12:41:10.565 AM | [ { "id": "d44c62a3cd37182adec884a1d67ca22db4837b76", "name": "ALBIngressControllerIAMPolicy", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy ALBIngressControllerIAMPolicy is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/ecfe31419d4532cc756383c3596763616f700641 | Authomize_v2_CL | |||||||||||||||
| 184 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:37.071 AM | 5ae2509d51eabf5555e7e8604f2ac617ff3959a5 | 3/6/2023, 11:40:24.663 PM | 5/2/2023, 12:41:10.566 AM | [ { "id": "643e13ad00cfd39c99fbe6357102b8f26b133b20", "name": "ingressController-iam-policy", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy ingressController-iam-policy is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/5ae2509d51eabf5555e7e8604f2ac617ff3959a5 | Authomize_v2_CL | |||||||||||||||
| 185 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:37.071 AM | 5f6e8ba92f84a2354dc12aa993a49ad6c610c9c1 | 3/6/2023, 11:40:24.653 PM | 5/2/2023, 12:41:10.565 AM | [ { "id": "88d511eab55ea61fcf68899fd2cf908422278ad8", "name": "ECR-Public-Read", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy ECR-Public-Read is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/5f6e8ba92f84a2354dc12aa993a49ad6c610c9c1 | Authomize_v2_CL | |||||||||||||||
| 186 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:37.071 AM | 4e84c6a5001c60119b9a06ee1e8df58775541a0a | 3/6/2023, 11:40:24.643 PM | 5/2/2023, 12:41:10.566 AM | [ { "id": "6e99ee0a4102da4da954a2e98e4e318d4604c83b", "name": "NamedGroupsEditPolicy", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy NamedGroupsEditPolicy is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/4e84c6a5001c60119b9a06ee1e8df58775541a0a | Authomize_v2_CL | |||||||||||||||
| 187 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:37.071 AM | 1e13d1add8b7ae9ec6b8446ae9d6e1ee6e89b61e | 3/6/2023, 11:40:24.638 PM | 5/2/2023, 12:41:10.566 AM | [ { "id": "07380f246cab87c62e632cc1b1faa3151deb60ba", "name": "ASG-Policy-For-Worker", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy ASG-Policy-For-Worker is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/1e13d1add8b7ae9ec6b8446ae9d6e1ee6e89b61e | Authomize_v2_CL | |||||||||||||||
| 188 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:37.071 AM | 1a093553e9212e51ae10bde42a384b59d038f642 | 3/6/2023, 11:40:24.629 PM | 5/2/2023, 12:41:10.566 AM | [ { "id": "eaec63f3d517b41633859943351852f93d40c2a2", "name": "ECR-Privvate-Read", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy ECR-Privvate-Read is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/1a093553e9212e51ae10bde42a384b59d038f642 | Authomize_v2_CL | |||||||||||||||
| 189 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:37.071 AM | af51f28cfec83f294e0b51ad142a72b528714322 | 3/6/2023, 11:40:24.623 PM | 5/2/2023, 12:41:10.566 AM | [ { "id": "202c0a7bd2f8948fadb9e13c27b1d8be15c99ecb", "name": "access", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy access is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/af51f28cfec83f294e0b51ad142a72b528714322 | Authomize_v2_CL | |||||||||||||||
| 190 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:37.071 AM | 61c3a7ce6f20d69f89a4d91ff5d100cc996fca4a | 3/6/2023, 11:40:24.616 PM | 5/2/2023, 12:41:10.565 AM | [ { "id": "889c2f0a337ec21ca973f42deec14ccbb0a46f0d", "name": "RolePolicyAttacher", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy RolePolicyAttacher is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/61c3a7ce6f20d69f89a4d91ff5d100cc996fca4a | Authomize_v2_CL | |||||||||||||||
| 191 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:37.071 AM | da61799106dbb5cb09609a1317e845cd5bb13de8 | 3/6/2023, 11:40:24.609 PM | 5/2/2023, 12:41:10.564 AM | [ { "id": "2adb13643a2fd9f3f14bde8aec9db3db77d11eb0", "name": "test_ec2_policy", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy test_ec2_policy is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/da61799106dbb5cb09609a1317e845cd5bb13de8 | Authomize_v2_CL | |||||||||||||||
| 192 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:38.461 AM | f80508e14d5e7e3923bc7f91f91818eca04079b3 | 3/6/2023, 11:40:24.600 PM | 5/2/2023, 12:41:10.564 AM | [ { "id": "f39dfeb11fca74e3116bc12be1d2f3f926bb4ba8", "name": "privesc21-PassExistingRoleToNewDataPipeline", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy privesc21-PassExistingRoleToNewDataPipeline is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/f80508e14d5e7e3923bc7f91f91818eca04079b3 | Authomize_v2_CL | |||||||||||||||
| 193 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:38.461 AM | bf700f07c895b3587c35add251dfcc57011cecbb | 3/6/2023, 11:40:24.594 PM | 5/2/2023, 12:41:10.566 AM | [ { "id": "c3e8ecd135424d3b9c508d0e930874a03c707dec", "name": "privesc14-UpdatingAssumeRolePolicy", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy privesc14-UpdatingAssumeRolePolicy is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/bf700f07c895b3587c35add251dfcc57011cecbb | Authomize_v2_CL | |||||||||||||||
| 194 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:38.461 AM | e864f70ba849c100ec0ec5b3ea6eaaf6a9251da1 | 3/6/2023, 11:40:24.583 PM | 5/2/2023, 12:41:10.565 AM | [ { "id": "336bcc6b56724bd5a4f326a944675f1a8eb0755b", "name": "privesc16-PassRoleToNewLambdaThenTriggerWithNewDynamo", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy privesc16-PassRoleToNewLambdaThenTriggerWithNewDynamo is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/e864f70ba849c100ec0ec5b3ea6eaaf6a9251da1 | Authomize_v2_CL | |||||||||||||||
| 195 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:38.461 AM | c0249f21c273a75973a603ff441be4bb443d6f36 | 3/6/2023, 11:40:24.575 PM | 5/2/2023, 12:41:10.566 AM | [ { "id": "f1a446520920356c69c8e26786f737fee1eea214", "name": "privesc2-SetExistingDefaultPolicyVersion", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy privesc2-SetExistingDefaultPolicyVersion is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/c0249f21c273a75973a603ff441be4bb443d6f36 | Authomize_v2_CL | |||||||||||||||
| 196 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:38.461 AM | 570535c84a8f73ac08e35858a77dac7bbeacc023 | 3/6/2023, 11:40:24.569 PM | 5/2/2023, 12:41:10.566 AM | [ { "id": "0459ec13b41db57dfdff472abe0c419b313e4b1e", "name": "privesc18-PassExistingRoleToNewGlueDevEndpoint", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy privesc18-PassExistingRoleToNewGlueDevEndpoint is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/570535c84a8f73ac08e35858a77dac7bbeacc023 | Authomize_v2_CL | |||||||||||||||
| 197 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:38.461 AM | f326f3fa06c2526eff714c3ad6a4baf01ec2c220 | 3/6/2023, 11:40:24.563 PM | 5/2/2023, 12:41:10.565 AM | [ { "id": "fa6557c3fe693af455ed653406d23238e3c1e306", "name": "allow-ec2-connection-policy", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy allow-ec2-connection-policy is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/f326f3fa06c2526eff714c3ad6a4baf01ec2c220 | Authomize_v2_CL | |||||||||||||||
| 198 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:38.461 AM | 786d92b788966c9d571dc667f759021a7874ea29 | 3/6/2023, 11:40:24.558 PM | 5/2/2023, 12:41:10.565 AM | [ { "id": "e33b7a3dcf6e35d27bb2b90a25d1aa80c3e53ab7", "name": "fn4-exploitableNotAction", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy fn4-exploitableNotAction is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/786d92b788966c9d571dc667f759021a7874ea29 | Authomize_v2_CL | |||||||||||||||
| 199 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:38.461 AM | 62a0ba10aa020eb0000b7d5d08df30302f979d56 | 3/6/2023, 11:40:24.552 PM | 5/2/2023, 12:41:10.564 AM | [ { "id": "4cb81b74f6a2c47ee9b6c79332abab6bc5d78ed7", "name": "privesc-sageMakerCreatePresignedNotebookURL-policy", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy privesc-sageMakerCreatePresignedNotebookURL-policy is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/62a0ba10aa020eb0000b7d5d08df30302f979d56 | Authomize_v2_CL | |||||||||||||||
| 200 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:38.461 AM | 5538c95091ad5a41f777898989f6fe048d8ebd18 | 3/6/2023, 11:40:24.545 PM | 5/2/2023, 12:41:10.564 AM | [ { "id": "6e8ca22b022d4ff402662707a867f395acc95919", "name": "fn2-exploitableResourceConstraint", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy fn2-exploitableResourceConstraint is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/5538c95091ad5a41f777898989f6fe048d8ebd18 | Authomize_v2_CL | |||||||||||||||
| 201 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:38.461 AM | e2f07a8fdd896007e4b1f911221f97e926b78271 | 3/6/2023, 11:40:24.538 PM | 5/2/2023, 12:41:10.564 AM | [ { "id": "0afd80657a46a13500cb9decc7a834b5d86c5c9b", "name": "privesc12-PutRolePolicy", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy privesc12-PutRolePolicy is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/e2f07a8fdd896007e4b1f911221f97e926b78271 | Authomize_v2_CL | |||||||||||||||
| 202 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:39.458 AM | 61eafffa6c6f1a26cde596ad510a1856962decb2 | 3/6/2023, 11:40:24.527 PM | 5/2/2023, 12:41:10.564 AM | [ { "id": "ba0985c76e6ae5734da778d25afc52e38767bd31", "name": "privesc9-AttachRolePolicy", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy privesc9-AttachRolePolicy is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/61eafffa6c6f1a26cde596ad510a1856962decb2 | Authomize_v2_CL | |||||||||||||||
| 203 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:39.458 AM | edcae24863caa368dfd698645d2edc2bb8ee8a49 | 3/6/2023, 11:40:24.519 PM | 5/2/2023, 12:41:10.564 AM | [ { "id": "3f37bbf4634032626d4cd04a049eeebebb07e057", "name": "allow-attaching-group-policy", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy allow-attaching-group-policy is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/edcae24863caa368dfd698645d2edc2bb8ee8a49 | Authomize_v2_CL | |||||||||||||||
| 204 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:39.458 AM | 7e03c2b9e314f1c738f331b45ca42ce6683558fd | 3/6/2023, 11:40:24.510 PM | 5/2/2023, 12:41:10.565 AM | [ { "id": "54c76281d3e30961863d8f56620d8c5ecef4eb73", "name": "attach-role-to-user", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy attach-role-to-user is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/7e03c2b9e314f1c738f331b45ca42ce6683558fd | Authomize_v2_CL | |||||||||||||||
| 205 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:39.458 AM | 590d2ca3d5db919e14be7e8e3f85e305ff5ac7f0 | 3/6/2023, 11:40:24.503 PM | 5/2/2023, 12:41:10.566 AM | [ { "id": "2608273e98a170f50b473b260dac619c9da9b42b", "name": "privesc3-CreateEC2WithExistingInstanceProfile", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy privesc3-CreateEC2WithExistingInstanceProfile is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/590d2ca3d5db919e14be7e8e3f85e305ff5ac7f0 | Authomize_v2_CL | |||||||||||||||
| 206 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:39.458 AM | 157bbb8855f7362f590ee836f9b23e02e4b214f7 | 3/6/2023, 11:40:24.491 PM | 5/2/2023, 12:41:10.566 AM | [ { "id": "4648e13068f749c36e268488e838e777c2035978", "name": "fp4-nonExploitableResourceConstraint", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy fp4-nonExploitableResourceConstraint is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/157bbb8855f7362f590ee836f9b23e02e4b214f7 | Authomize_v2_CL | |||||||||||||||
| 207 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:39.458 AM | d1fa4a5755dec5feca872f3c134641c8df3dbd90 | 3/6/2023, 11:40:24.477 PM | 5/2/2023, 12:41:10.566 AM | [ { "id": "5372b8ab7c06a3c604f8484c7509bcc7b3b0cbd4", "name": "privesc-sageMakerCreateProcessingJobPassRole-policy", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy privesc-sageMakerCreateProcessingJobPassRole-policy is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/d1fa4a5755dec5feca872f3c134641c8df3dbd90 | Authomize_v2_CL | |||||||||||||||
| 208 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:39.458 AM | 01d383fb3b5275ca7f2ab284b487cc43dc3460d1 | 3/6/2023, 11:40:24.470 PM | 5/2/2023, 12:41:10.565 AM | [ { "id": "38b90880fbbf131a2230eafe80609923f11448d0", "name": "privesc19-UpdateExistingGlueDevEndpoint", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy privesc19-UpdateExistingGlueDevEndpoint is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/01d383fb3b5275ca7f2ab284b487cc43dc3460d1 | Authomize_v2_CL | |||||||||||||||
| 209 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:39.458 AM | 54c8f5b903fe3a9c84dbbd31f3b0125d829a2abd | 3/6/2023, 11:40:24.463 PM | 5/2/2023, 12:41:10.564 AM | [ { "id": "6675a9d9f66cfd3eb3a96ab0a52417600ac7f0cc", "name": "create-access-keys", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy create-access-keys is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/54c8f5b903fe3a9c84dbbd31f3b0125d829a2abd | Authomize_v2_CL | |||||||||||||||
| 210 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:39.458 AM | db6851995dc0dee42871bec59fd02ed4a5ff8500 | 3/6/2023, 11:40:24.455 PM | 5/2/2023, 12:41:10.564 AM | [ { "id": "7e53c3fa7e29d1393a4b8dee742523231e53118b", "name": "privesc17-EditExistingLambdaFunctionWithRole", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy privesc17-EditExistingLambdaFunctionWithRole is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/db6851995dc0dee42871bec59fd02ed4a5ff8500 | Authomize_v2_CL | |||||||||||||||
| 211 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:39.458 AM | 445deea8d90d5c6790b575fdc5bd9a25d288e3d2 | 3/6/2023, 11:40:24.447 PM | 5/2/2023, 12:41:10.564 AM | [ { "id": "fcdc1ca6686c86d58dc2af2b40c67b0988721d1c", "name": "privesc-sageMakerCreateTrainingJobPassRole-policy", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy privesc-sageMakerCreateTrainingJobPassRole-policy is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/445deea8d90d5c6790b575fdc5bd9a25d288e3d2 | Authomize_v2_CL | |||||||||||||||
| 212 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:40.415 AM | c33d7cc37d015addee42f31e920a4dd51e0e4c19 | 3/6/2023, 11:40:24.435 PM | 5/2/2023, 12:41:10.566 AM | [ { "id": "a6bffe66d5d9072a8a786795e098f482fc15f327", "name": "privesc-CloudFormationUpdateStack", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy privesc-CloudFormationUpdateStack is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/c33d7cc37d015addee42f31e920a4dd51e0e4c19 | Authomize_v2_CL | |||||||||||||||
| 213 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:40.415 AM | 041e3026fd1d5374d997cf0b66ee18d0df0967b7 | 3/6/2023, 11:40:24.419 PM | 5/2/2023, 12:41:10.566 AM | [ { "id": "d9b3cfcdfca7369d0ad3decbd61d3c1679266295", "name": "privesc-ssmStartSession-policy", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy privesc-ssmStartSession-policy is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/041e3026fd1d5374d997cf0b66ee18d0df0967b7 | Authomize_v2_CL | |||||||||||||||
| 214 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:40.415 AM | e412222cc4542b5795b4131f29444701090e92e3 | 3/6/2023, 11:40:24.412 PM | 5/2/2023, 12:41:10.564 AM | [ { "id": "764d204cd3e35923dd11eac6d5af2da5c2bccaac", "name": "privesc-sageMakerCreateNotebookPassRole-policy", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy privesc-sageMakerCreateNotebookPassRole-policy is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/e412222cc4542b5795b4131f29444701090e92e3 | Authomize_v2_CL | |||||||||||||||
| 215 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:40.415 AM | 989657ac4b458f30760eaac2cb55086f13d5ad38 | 3/6/2023, 11:40:24.406 PM | 5/2/2023, 12:41:10.565 AM | [ { "id": "56b31e48a5454a5f93e287e782ea23c157ab74a6", "name": "privesc13-AddUserToGroup", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy privesc13-AddUserToGroup is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/989657ac4b458f30760eaac2cb55086f13d5ad38 | Authomize_v2_CL | |||||||||||||||
| 216 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:40.415 AM | 7f77cc3bca5f1523214345816c61af46adb062a2 | 3/6/2023, 11:40:24.394 PM | 5/2/2023, 12:41:10.565 AM | [ { "id": "dfb45cbf132af73decf83b3b2c5b129138eecab6", "name": "fp5-nonExploitableConditionConstraint", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy fp5-nonExploitableConditionConstraint is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/7f77cc3bca5f1523214345816c61af46adb062a2 | Authomize_v2_CL | |||||||||||||||
| 217 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:40.415 AM | d764940905162756577c5b99e6858f39d54065c3 | 3/6/2023, 11:40:24.383 PM | 5/2/2023, 12:41:10.566 AM | [ { "id": "5ff083fb125858b500ed19c5236735f102245c55", "name": "privesc-codeBuildCreateProjectPassRole-policy", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy privesc-codeBuildCreateProjectPassRole-policy is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/d764940905162756577c5b99e6858f39d54065c3 | Authomize_v2_CL | |||||||||||||||
| 218 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:40.415 AM | dedb154170ad186b12a7c7ff6cfdc664fae23bec | 3/6/2023, 11:40:24.373 PM | 5/2/2023, 12:41:10.564 AM | [ { "id": "907618a03fae8ab142b12f70a0814ad9b581647b", "name": "rndGroup", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy rndGroup is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/dedb154170ad186b12a7c7ff6cfdc664fae23bec | Authomize_v2_CL | |||||||||||||||
| 219 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:40.415 AM | 0fc94da3978171868c9ef3b78fcea9072de7ffec | 3/6/2023, 11:40:24.367 PM | 5/2/2023, 12:41:10.565 AM | [ { "id": "8b96d0a6d33a372093a7805d013ea0dcf9cf6049", "name": "privesc10-PutUserPolicy", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy privesc10-PutUserPolicy is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/0fc94da3978171868c9ef3b78fcea9072de7ffec | Authomize_v2_CL | |||||||||||||||
| 220 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:40.415 AM | 14ac67a0b2da26af8e703c9bbd2722ec64fd480b | 3/6/2023, 11:40:24.356 PM | 5/2/2023, 12:41:10.565 AM | [ { "id": "dccbdcd8d0e3be76498a70f58fa383331fe9c1da", "name": "privesc11-PutGroupPolicy", "object": "asset", "originId": null, "originType": "PolicyResource" } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Misconfiguration | [ "Initial Access", "Privilege Escalation" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-05" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-08" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | Low | 91723192711 | 91723192711 | IaaS policy not attached to any identity | 88391680491 | It is recommended to delete the detached policy to reduce the potential risk of an insider threat or in case of an attack. | User defined AWS policy privesc11-PutGroupPolicy is not attached to any identity (User, Group or Role). | false | https://msftriskyuser.authomize.com/incidents/14ac67a0b2da26af8e703c9bbd2722ec64fd480b | Authomize_v2_CL | |||||||||||||||
| 221 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:40.415 AM | 39fa19610a14b57db0b18ae7b314a4283bd22933 | 3/6/2023, 11:40:18.948 PM | 5/2/2023, 12:41:13.705 AM | [ { "id": "04d5be4fda16548fdc0b0c7a20701cc4a108a769", "name": "AuthomizeCustomerRoleAssumer", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [] | [ { "values": [ "5.1", "3.1" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-03" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.1", "A.8.1.1" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC3.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-10" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 91723190746 | 91723190746 | Detect AWS IAM Users | 88391685076 | Make sure this IAM account is necessary If this account is temporary, remember to deactivate or remove it once not required anymore. | IAM user AuthomizeCustomerRoleAssumer was detected in AWS. | false | https://msftriskyuser.authomize.com/incidents/39fa19610a14b57db0b18ae7b314a4283bd22933 | Authomize_v2_CL | |||||||||||||||
| 222 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:43.186 AM | 30ec975e87c20a08ca4c4e3e5b82b3ec027a2050 | 3/6/2023, 11:36:42.350 PM | 5/2/2023, 12:34:25.595 AM | [ { "id": "9cc92bab3b013e0b94caf1e21ec49f1dde3cf0d6", "name": "rnd-instance-managment", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2", "A.9.2.2", "A.9.4.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-05", "IAM-02" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 74705321436 | 74705321436 | Access to AWS without MFA | 74701855853 | Require MFA for all IAM users Require MFA for all users in your IdP. If that is not possible, make sure that those with access to IaaS environments have MFA enabled. | rnd-instance-managment's AWS account does not have MFA enabled | false | https://msftriskyuser.authomize.com/incidents/30ec975e87c20a08ca4c4e3e5b82b3ec027a2050 | Authomize_v2_CL | |||||||||||||||
| 223 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:43.186 AM | 4c1f7b64ed843b0926f942006d6bdbae1ac68331 | 3/6/2023, 11:36:42.339 PM | 5/2/2023, 12:34:25.595 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2", "A.9.2.2", "A.9.4.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-05", "IAM-02" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 74705321436 | 74705321436 | Access to AWS without MFA | 74701855853 | Require MFA for all IAM users Require MFA for all users in your IdP. If that is not possible, make sure that those with access to IaaS environments have MFA enabled. | cli user's AWS account does not have MFA enabled | false | https://msftriskyuser.authomize.com/incidents/4c1f7b64ed843b0926f942006d6bdbae1ac68331 | Authomize_v2_CL | |||||||||||||||
| 224 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:43.186 AM | a69fc53f9ae6975cf5db19d8cb1b71af5bd3e7c9 | 3/6/2023, 11:36:42.327 PM | 5/2/2023, 12:34:25.593 AM | [ { "id": "04d5be4fda16548fdc0b0c7a20701cc4a108a769", "name": "AuthomizeCustomerRoleAssumer", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2", "A.9.2.2", "A.9.4.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-05", "IAM-02" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 74705321436 | 74705321436 | Access to AWS without MFA | 74701855853 | Require MFA for all IAM users Require MFA for all users in your IdP. If that is not possible, make sure that those with access to IaaS environments have MFA enabled. | AuthomizeCustomerRoleAssumer's AWS account does not have MFA enabled | false | https://msftriskyuser.authomize.com/incidents/a69fc53f9ae6975cf5db19d8cb1b71af5bd3e7c9 | Authomize_v2_CL | |||||||||||||||
| 225 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:43.186 AM | 776ab648e18d953a911aae8108664bd20c9088b0 | 3/6/2023, 11:36:42.314 PM | 5/2/2023, 12:34:25.593 AM | [ { "id": "6147e2cb17bb389c1d97e274e0e844d1a30f3763", "name": "rnd-management", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2", "A.9.2.2", "A.9.4.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-05", "IAM-02" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 74705321436 | 74705321436 | Access to AWS without MFA | 74701855853 | Require MFA for all IAM users Require MFA for all users in your IdP. If that is not possible, make sure that those with access to IaaS environments have MFA enabled. | rnd-management's AWS account does not have MFA enabled | false | https://msftriskyuser.authomize.com/incidents/776ab648e18d953a911aae8108664bd20c9088b0 | Authomize_v2_CL | |||||||||||||||
| 226 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:43.186 AM | 95714d0180599afd9f0c53467108cf8aecc3ba3d | 3/6/2023, 11:36:42.259 PM | 5/2/2023, 12:34:25.594 AM | [ { "id": "0dc77cd79ca8e4a97c12db8241463a9615d8f7f6", "name": "devop-admin", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2", "A.9.2.2", "A.9.4.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-05", "IAM-02" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 74705321436 | 74705321436 | Access to AWS without MFA | 74701855853 | Require MFA for all IAM users Require MFA for all users in your IdP. If that is not possible, make sure that those with access to IaaS environments have MFA enabled. | devop-admin's AWS account does not have MFA enabled | false | https://msftriskyuser.authomize.com/incidents/95714d0180599afd9f0c53467108cf8aecc3ba3d | Authomize_v2_CL | |||||||||||||||
| 227 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:43.186 AM | 1c551fef10057105b23b1f4527d8bfd7d14d071c | 3/6/2023, 11:36:42.243 PM | 5/2/2023, 12:34:25.595 AM | [ { "id": "cba1878c0d07a5530b835a9198cd67dd3ab99502", "name": "AuthomizeMasterAccountUser", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2", "A.9.2.2", "A.9.4.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-05", "IAM-02" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 74705321436 | 74705321436 | Access to AWS without MFA | 74701855853 | Require MFA for all IAM users Require MFA for all users in your IdP. If that is not possible, make sure that those with access to IaaS environments have MFA enabled. | AuthomizeMasterAccountUser's AWS account does not have MFA enabled | false | https://msftriskyuser.authomize.com/incidents/1c551fef10057105b23b1f4527d8bfd7d14d071c | Authomize_v2_CL | |||||||||||||||
| 228 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:43.186 AM | 255239611c963d6c3ec77cf172efc0aad778a934 | 3/6/2023, 11:36:42.227 PM | 5/2/2023, 12:34:25.596 AM | [ { "id": "ef1aaecb0869343318c6e4af3e9bfe0326a68d9c", "name": "phillip carpenter@acme com", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2", "A.9.2.2", "A.9.4.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-05", "IAM-02" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 74705321436 | 74705321436 | Access to AWS without MFA | 74701855853 | Require MFA for all IAM users Require MFA for all users in your IdP. If that is not possible, make sure that those with access to IaaS environments have MFA enabled. | phillip carpenter@acme com's AWS account does not have MFA enabled | false | https://msftriskyuser.authomize.com/incidents/255239611c963d6c3ec77cf172efc0aad778a934 | Authomize_v2_CL | |||||||||||||||
| 229 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:43.186 AM | 09dd26897427301b15c0feee652874027e5bc87e | 3/6/2023, 11:36:42.219 PM | 5/2/2023, 12:34:25.594 AM | [ { "id": "95fb6c89a1dcd4d27797905a128aee1cef508898", "name": "role chaining user", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2", "A.9.2.2", "A.9.4.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-05", "IAM-02" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 74705321436 | 74705321436 | Access to AWS without MFA | 74701855853 | Require MFA for all IAM users Require MFA for all users in your IdP. If that is not possible, make sure that those with access to IaaS environments have MFA enabled. | role chaining user's AWS account does not have MFA enabled | false | https://msftriskyuser.authomize.com/incidents/09dd26897427301b15c0feee652874027e5bc87e | Authomize_v2_CL | |||||||||||||||
| 230 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:43.186 AM | f57a9e43ff6bfe070a505ea3881d11dce7433843 | 3/6/2023, 11:36:42.212 PM | 5/2/2023, 12:34:25.595 AM | [ { "id": "725737663b035a749c31dd80746bf014d1847f00", "name": "OktaSSOuser", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.1.2", "A.9.2.2", "A.9.4.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-05", "IAM-02" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 74705321436 | 74705321436 | Access to AWS without MFA | 74701855853 | Require MFA for all IAM users Require MFA for all users in your IdP. If that is not possible, make sure that those with access to IaaS environments have MFA enabled. | OktaSSOuser's AWS account does not have MFA enabled | false | https://msftriskyuser.authomize.com/incidents/f57a9e43ff6bfe070a505ea3881d11dce7433843 | Authomize_v2_CL | |||||||||||||||
| 231 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:43.186 AM | d30fb76dc16e1c18a7bbfab70c6f49d2239b1efb | 3/6/2023, 8:38:44.202 PM | 5/2/2023, 12:41:13.706 AM | [ { "id": "2cee0622e84e4f94a1f24fc77499544568f77d30", "name": "lambda-func-support", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [] | [ { "values": [ "5.1", "3.1" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-03" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.1", "A.8.1.1" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC3.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-10" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 91723190746 | 91723190746 | Detect AWS IAM Users | 88391685076 | Make sure this IAM account is necessary If this account is temporary, remember to deactivate or remove it once not required anymore. | IAM user lambda-func-support was detected in AWS. | false | https://msftriskyuser.authomize.com/incidents/d30fb76dc16e1c18a7bbfab70c6f49d2239b1efb | Authomize_v2_CL | |||||||||||||||
| 232 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:44.964 AM | 14a526a1f08b56c075f0cb449579fe77dd37c474 | 3/6/2023, 8:38:44.197 PM | 5/2/2023, 12:41:13.705 AM | [ { "id": "bf2be9d8713021d095f0f043f73a9234ca5ed1cc", "name": "manage-policies", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [] | [ { "values": [ "5.1", "3.1" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-03" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.1", "A.8.1.1" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC3.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-10" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 91723190746 | 91723190746 | Detect AWS IAM Users | 88391685076 | Make sure this IAM account is necessary If this account is temporary, remember to deactivate or remove it once not required anymore. | IAM user manage-policies was detected in AWS. | false | https://msftriskyuser.authomize.com/incidents/14a526a1f08b56c075f0cb449579fe77dd37c474 | Authomize_v2_CL | |||||||||||||||
| 233 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:44.964 AM | 55217a541115a6f7a4848f9ca22303660a39a6b6 | 3/6/2023, 8:38:44.190 PM | 5/2/2023, 12:41:13.705 AM | [ { "id": "b21f017e7fdd4b5079fd2d43dd37ef34b6b8c48b", "name": "kim rice@acme com", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [] | [ { "values": [ "5.1", "3.1" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-03" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.1", "A.8.1.1" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC3.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-10" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 91723190746 | 91723190746 | Detect AWS IAM Users | 88391685076 | Make sure this IAM account is necessary If this account is temporary, remember to deactivate or remove it once not required anymore. | IAM user kim rice@acme com was detected in AWS. | false | https://msftriskyuser.authomize.com/incidents/55217a541115a6f7a4848f9ca22303660a39a6b6 | Authomize_v2_CL | |||||||||||||||
| 234 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:44.964 AM | 0eb679a0e3bf1cad6aea127508e5a63709b5f310 | 3/6/2023, 8:38:44.184 PM | 5/2/2023, 12:41:13.705 AM | [ { "id": "9cc92bab3b013e0b94caf1e21ec49f1dde3cf0d6", "name": "rnd-instance-managment", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [] | [ { "values": [ "5.1", "3.1" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-03" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.1", "A.8.1.1" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC3.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-10" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 91723190746 | 91723190746 | Detect AWS IAM Users | 88391685076 | Make sure this IAM account is necessary If this account is temporary, remember to deactivate or remove it once not required anymore. | IAM user rnd-instance-managment was detected in AWS. | false | https://msftriskyuser.authomize.com/incidents/0eb679a0e3bf1cad6aea127508e5a63709b5f310 | Authomize_v2_CL | |||||||||||||||
| 235 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:44.964 AM | 905a600894718b5457867c79f835dd06c5edee41 | 3/6/2023, 8:38:44.178 PM | 5/2/2023, 12:41:13.706 AM | [ { "id": "45497fa17b3f81d87119984b947b48658ba28cf0", "name": "cli user", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [] | [ { "values": [ "5.1", "3.1" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-03" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.1", "A.8.1.1" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC3.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-10" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 91723190746 | 91723190746 | Detect AWS IAM Users | 88391685076 | Make sure this IAM account is necessary If this account is temporary, remember to deactivate or remove it once not required anymore. | IAM user cli user was detected in AWS. | false | https://msftriskyuser.authomize.com/incidents/905a600894718b5457867c79f835dd06c5edee41 | Authomize_v2_CL | |||||||||||||||
| 236 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:44.964 AM | 92f1281372193dbb554c513fd05fb0671f3414ad | 3/6/2023, 8:38:44.171 PM | 5/2/2023, 12:41:13.706 AM | [ { "id": "6147e2cb17bb389c1d97e274e0e844d1a30f3763", "name": "rnd-management", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [] | [ { "values": [ "5.1", "3.1" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-03" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.1", "A.8.1.1" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC3.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-10" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 91723190746 | 91723190746 | Detect AWS IAM Users | 88391685076 | Make sure this IAM account is necessary If this account is temporary, remember to deactivate or remove it once not required anymore. | IAM user rnd-management was detected in AWS. | false | https://msftriskyuser.authomize.com/incidents/92f1281372193dbb554c513fd05fb0671f3414ad | Authomize_v2_CL | |||||||||||||||
| 237 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:44.964 AM | ffc17506a5d91acda8dc66470040bc361262294f | 3/6/2023, 8:38:44.165 PM | 5/2/2023, 12:41:13.704 AM | [ { "id": "0dc77cd79ca8e4a97c12db8241463a9615d8f7f6", "name": "devop-admin", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [] | [ { "values": [ "5.1", "3.1" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-03" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.1", "A.8.1.1" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC3.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-10" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 91723190746 | 91723190746 | Detect AWS IAM Users | 88391685076 | Make sure this IAM account is necessary If this account is temporary, remember to deactivate or remove it once not required anymore. | IAM user devop-admin was detected in AWS. | false | https://msftriskyuser.authomize.com/incidents/ffc17506a5d91acda8dc66470040bc361262294f | Authomize_v2_CL | |||||||||||||||
| 238 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:44.964 AM | b866d3b2266d6c4440f76146e5d95077406602ea | 3/6/2023, 8:38:44.159 PM | 5/2/2023, 12:41:13.704 AM | [ { "id": "ef1aaecb0869343318c6e4af3e9bfe0326a68d9c", "name": "phillip carpenter@acme com", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [] | [ { "values": [ "5.1", "3.1" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-03" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.1", "A.8.1.1" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC3.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-10" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 91723190746 | 91723190746 | Detect AWS IAM Users | 88391685076 | Make sure this IAM account is necessary If this account is temporary, remember to deactivate or remove it once not required anymore. | IAM user phillip carpenter@acme com was detected in AWS. | false | https://msftriskyuser.authomize.com/incidents/b866d3b2266d6c4440f76146e5d95077406602ea | Authomize_v2_CL | |||||||||||||||
| 239 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:44.964 AM | a4c18c14289f657e683cc9a6d1bd523581d35024 | 3/6/2023, 8:38:44.153 PM | 5/2/2023, 12:41:13.706 AM | [ { "id": "95fb6c89a1dcd4d27797905a128aee1cef508898", "name": "role chaining user", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [] | [ { "values": [ "5.1", "3.1" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-03" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.1", "A.8.1.1" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC3.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-10" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 91723190746 | 91723190746 | Detect AWS IAM Users | 88391685076 | Make sure this IAM account is necessary If this account is temporary, remember to deactivate or remove it once not required anymore. | IAM user role chaining user was detected in AWS. | false | https://msftriskyuser.authomize.com/incidents/a4c18c14289f657e683cc9a6d1bd523581d35024 | Authomize_v2_CL | |||||||||||||||
| 240 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:44.964 AM | a9a1ca4f09a05aafc5e292c6d76183aa6ecf55a5 | 3/6/2023, 8:38:44.147 PM | 5/2/2023, 12:41:13.704 AM | [ { "id": "725737663b035a749c31dd80746bf014d1847f00", "name": "OktaSSOuser", "object": "identity", "email": null } ] | [ { "id": "8b2864988275496f8e94fc5b44f6d55d08555033", "name": "AWS" } ] | Privileged Access | [] | [ { "values": [ "5.1", "3.1" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-03" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.1", "A.8.1.1" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC3.3" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-10" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [] | Open | High | 91723190746 | 91723190746 | Detect AWS IAM Users | 88391685076 | Make sure this IAM account is necessary If this account is temporary, remember to deactivate or remove it once not required anymore. | IAM user OktaSSOuser was detected in AWS. | false | https://msftriskyuser.authomize.com/incidents/a9a1ca4f09a05aafc5e292c6d76183aa6ecf55a5 | Authomize_v2_CL | |||||||||||||||
| 241 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:44.964 AM | 1ec844535eb59cacbaca61d6ddb3678321cdf7ff | 2/1/2023, 10:03:15.600 PM | 5/2/2023, 12:40:41.608 AM | [ { "id": "c90c8f880f8fa9051f380714b2f94434184cd3fd", "name": "Joni Sherman", "object": "identity", "email": null } ] | [ { "id": "7c723f6aaa1d472954f30719c1c13b2d82ae60ec", "name": "RiskyUser" } ] | Misconfiguration | [ "Credential Access", "Initial Access", "Privilege Escalation" ] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-14", "DSP-07", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.2", "A.9.1.2", "A.9.2.2", "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-01", "IAM-02", "IAM-05" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [ "Valid Accounts", "Account Manipulation" ] | Open | High | 79385387773 | 79385387773 | Risky Users with no MFA | 78651533898 | Ensure that Joni Sherman enables MFA. | Customized Integration user Joni Sherman has no multi factor authentication (MFA) set up. | false | https://msftriskyuser.authomize.com/incidents/1ec844535eb59cacbaca61d6ddb3678321cdf7ff | Authomize_v2_CL | |||||||||||||||
| 242 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:46.273 AM | 8c9d13c1597e82bb11e9aabc8dc9588ab921fcdc | 1/25/2023, 10:02:38.117 PM | 5/2/2023, 12:40:41.608 AM | [ { "id": "b7fa3acc7b77a24339605577446a5cf103fb2c00", "name": "Henrietta Mueller", "object": "identity", "email": null } ] | [ { "id": "7c723f6aaa1d472954f30719c1c13b2d82ae60ec", "name": "RiskyUser" } ] | Misconfiguration | [ "Credential Access", "Initial Access", "Privilege Escalation" ] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-14", "DSP-07", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.2", "A.9.1.2", "A.9.2.2", "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-01", "IAM-02", "IAM-05" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [ "Valid Accounts", "Account Manipulation" ] | Open | High | 79385387773 | 79385387773 | Risky Users with no MFA | 78651533898 | Ensure that Henrietta Mueller enables MFA. | Customized Integration user Henrietta Mueller has no multi factor authentication (MFA) set up. | false | https://msftriskyuser.authomize.com/incidents/8c9d13c1597e82bb11e9aabc8dc9588ab921fcdc | Authomize_v2_CL | |||||||||||||||
| 243 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:46.273 AM | bb4c621c9e7e63c0fda6cdfaf08f8f097dbe6161 | 1/25/2023, 10:02:38.117 PM | 5/2/2023, 12:40:41.609 AM | [ { "id": "a43f28ae7266ddbe95a3dedacebc1d75d7ed0521", "name": "Lidia Holloway", "object": "identity", "email": null } ] | [ { "id": "7c723f6aaa1d472954f30719c1c13b2d82ae60ec", "name": "RiskyUser" } ] | Misconfiguration | [ "Credential Access", "Initial Access", "Privilege Escalation" ] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-14", "DSP-07", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.2", "A.9.1.2", "A.9.2.2", "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-01", "IAM-02", "IAM-05" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [ "Valid Accounts", "Account Manipulation" ] | Open | High | 79385387773 | 79385387773 | Risky Users with no MFA | 78651533898 | Ensure that Lidia Holloway enables MFA. | Customized Integration user Lidia Holloway has no multi factor authentication (MFA) set up. | false | https://msftriskyuser.authomize.com/incidents/bb4c621c9e7e63c0fda6cdfaf08f8f097dbe6161 | Authomize_v2_CL | |||||||||||||||
| 244 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:46.273 AM | 25a7e28e71bc60c37c411e7427b30b8fe715fc87 | 1/25/2023, 10:01:26.875 PM | 5/2/2023, 12:38:43.836 AM | [ { "id": "a536f7ea69a417200e5722a2373e6ffe8d3d147f", "name": "Steven Riley", "object": "identity", "email": null } ] | [ { "id": "f0c8aa9c67004699b20c284c3cfa89f0de3078c7", "name": "Microsoft Active Directory - MSFT" } ] | Privileged Access | [ "Initial Access", "Persistence", "Privilege Escalation", "Defense Evasion", "Credential Access", "Exfiltration" ] | [ { "values": [ "5.1" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-03" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.1", "A.8.1.1" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-10" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [ "Cloud Service Dashboard", "Cloud Service Discovery", "Account Manipulation", "Trusted Relationship", "Valid Accounts", "Transfer Data to Cloud Account" ] | Open | High | 74705345470 | 74705345470 | Admin SaaS account detected | 74701857152 | Limit the number of administrative access policies granted. Restricting administrative privileges is one of the most effective mitigation strategies in ensuring the security of systems. | Administrator discovered | false | https://msftriskyuser.authomize.com/incidents/25a7e28e71bc60c37c411e7427b30b8fe715fc87 | Authomize_v2_CL | |||||||||||||||
| 245 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:46.273 AM | 3a13ac12250841057b4531f0499c52bf51ad5353 | 1/25/2023, 10:01:26.875 PM | 5/2/2023, 12:38:43.836 AM | [ { "id": "81c7a1ed4a05cb47ce02dd9f0ebe3fb1d2756d02", "name": "Global Administrator", "object": "identity", "email": null } ] | [ { "id": "f0c8aa9c67004699b20c284c3cfa89f0de3078c7", "name": "Microsoft Active Directory - MSFT" } ] | Privileged Access | [ "Initial Access", "Persistence", "Privilege Escalation", "Defense Evasion", "Credential Access", "Exfiltration" ] | [ { "values": [ "5.1" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-03" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.1", "A.8.1.1" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-10" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [ "Cloud Service Dashboard", "Cloud Service Discovery", "Account Manipulation", "Trusted Relationship", "Valid Accounts", "Transfer Data to Cloud Account" ] | Open | High | 74705345470 | 74705345470 | Admin SaaS account detected | 74701857152 | Limit the number of administrative access policies granted. Restricting administrative privileges is one of the most effective mitigation strategies in ensuring the security of systems. | Administrator discovered | false | https://msftriskyuser.authomize.com/incidents/3a13ac12250841057b4531f0499c52bf51ad5353 | Authomize_v2_CL | |||||||||||||||
| 246 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:46.273 AM | 065082465817601006bfe6a97aba2943b2dc75df | 1/25/2023, 10:01:18.383 PM | 5/2/2023, 12:37:45.984 AM | [ { "id": "2fd124fdf3babe6ae53b1394d6eed9c0b9f18844", "name": "All Personal drives", "object": "asset", "originId": null, "originType": null }, { "id": "a536f7ea69a417200e5722a2373e6ffe8d3d147f", "name": "Steven Riley", "object": "identity", "email": null }, { "id": "3cbcaec94f6e10f6bd29da05adb4932cd246b496", "name": "Global Administrator", "object": "identity", "email": null } ] | [ { "id": "f0c8aa9c67004699b20c284c3cfa89f0de3078c7", "name": "Microsoft Active Directory - MSFT" } ] | Privileged Access | [ "Initial Access", "Persistence", "Privilege Escalation", "Defense Evasion", "Credential Access" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-03" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" } ] | [ "Cloud Service Discovery" ] | Open | High | 74705344818 | 74705344818 | User assigned to a default admin role | 74701857498 | Never use default administrative roles unless you have no other option. Make sure users with administrative roles have separate accounts for daily work. Make sure MFA is enabled for this account. | New default administrator role assigned | false | https://msftriskyuser.authomize.com/incidents/065082465817601006bfe6a97aba2943b2dc75df | Authomize_v2_CL | |||||||||||||||
| 247 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:46.273 AM | 11ae051c529eba27f239d85180a15e499a8f5edd | 1/25/2023, 10:01:18.383 PM | 5/2/2023, 12:37:45.984 AM | [ { "id": "f0c8aa9c67004699b20c284c3cfa89f0de3078c7", "name": "Microsoft Active Directory - MSFT", "object": "asset", "originId": null, "originType": null }, { "id": "a536f7ea69a417200e5722a2373e6ffe8d3d147f", "name": "Steven Riley", "object": "identity", "email": null }, { "id": "3cbcaec94f6e10f6bd29da05adb4932cd246b496", "name": "Global Administrator", "object": "identity", "email": null } ] | [ { "id": "f0c8aa9c67004699b20c284c3cfa89f0de3078c7", "name": "Microsoft Active Directory - MSFT" } ] | Privileged Access | [ "Initial Access", "Persistence", "Privilege Escalation", "Defense Evasion", "Credential Access" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-03" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" } ] | [ "Cloud Service Discovery" ] | Open | High | 74705344818 | 74705344818 | User assigned to a default admin role | 74701857498 | Never use default administrative roles unless you have no other option. Make sure users with administrative roles have separate accounts for daily work. Make sure MFA is enabled for this account. | New default administrator role assigned | false | https://msftriskyuser.authomize.com/incidents/11ae051c529eba27f239d85180a15e499a8f5edd | Authomize_v2_CL | |||||||||||||||
| 248 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:46.273 AM | 25b8e5eff21aab55f359e7b329c16839ea8415d9 | 1/25/2023, 10:01:18.383 PM | 5/2/2023, 12:37:45.985 AM | [ { "id": "f2ce75c849cb957db593ba1e3fe492a7284308b3", "name": "All Sharepoint drives", "object": "asset", "originId": null, "originType": null }, { "id": "a536f7ea69a417200e5722a2373e6ffe8d3d147f", "name": "Steven Riley", "object": "identity", "email": null }, { "id": "3cbcaec94f6e10f6bd29da05adb4932cd246b496", "name": "Global Administrator", "object": "identity", "email": null } ] | [ { "id": "f0c8aa9c67004699b20c284c3cfa89f0de3078c7", "name": "Microsoft Active Directory - MSFT" } ] | Privileged Access | [ "Initial Access", "Persistence", "Privilege Escalation", "Defense Evasion", "Credential Access" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-03" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" } ] | [ "Cloud Service Discovery" ] | Open | High | 74705344818 | 74705344818 | User assigned to a default admin role | 74701857498 | Never use default administrative roles unless you have no other option. Make sure users with administrative roles have separate accounts for daily work. Make sure MFA is enabled for this account. | New default administrator role assigned | false | https://msftriskyuser.authomize.com/incidents/25b8e5eff21aab55f359e7b329c16839ea8415d9 | Authomize_v2_CL | |||||||||||||||
| 249 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:46.273 AM | 4928056997abcd97e044b73d123bdf054767f52e | 1/25/2023, 10:01:18.383 PM | 5/2/2023, 12:37:45.986 AM | [ { "id": "fe985b202df8f2b487cba173cf6200e0733e63ab", "name": "MSFT", "object": "asset", "originId": null, "originType": null }, { "id": "a536f7ea69a417200e5722a2373e6ffe8d3d147f", "name": "Steven Riley", "object": "identity", "email": null }, { "id": "3cbcaec94f6e10f6bd29da05adb4932cd246b496", "name": "Global Administrator", "object": "identity", "email": null } ] | [ { "id": "f0c8aa9c67004699b20c284c3cfa89f0de3078c7", "name": "Microsoft Active Directory - MSFT" } ] | Privileged Access | [ "Initial Access", "Persistence", "Privilege Escalation", "Defense Evasion", "Credential Access" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-03" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" } ] | [ "Cloud Service Discovery" ] | Open | High | 74705344818 | 74705344818 | User assigned to a default admin role | 74701857498 | Never use default administrative roles unless you have no other option. Make sure users with administrative roles have separate accounts for daily work. Make sure MFA is enabled for this account. | New default administrator role assigned | false | https://msftriskyuser.authomize.com/incidents/4928056997abcd97e044b73d123bdf054767f52e | Authomize_v2_CL | |||||||||||||||
| 250 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:46.273 AM | ca1b9b775244e1dee0834e9c6a6acc816c4aad83 | 1/25/2023, 10:01:18.383 PM | 5/2/2023, 12:37:45.986 AM | [ { "id": "1441bd5dcf06ddc16a2215fe005fd11365e9e3ce", "name": "Microsoft MSFT", "object": "asset", "originId": null, "originType": null }, { "id": "a536f7ea69a417200e5722a2373e6ffe8d3d147f", "name": "Steven Riley", "object": "identity", "email": null }, { "id": "3cbcaec94f6e10f6bd29da05adb4932cd246b496", "name": "Global Administrator", "object": "identity", "email": null } ] | [ { "id": "f0c8aa9c67004699b20c284c3cfa89f0de3078c7", "name": "Microsoft Active Directory - MSFT" } ] | Privileged Access | [ "Initial Access", "Persistence", "Privilege Escalation", "Defense Evasion", "Credential Access" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-03" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" } ] | [ "Cloud Service Discovery" ] | Open | High | 74705344818 | 74705344818 | User assigned to a default admin role | 74701857498 | Never use default administrative roles unless you have no other option. Make sure users with administrative roles have separate accounts for daily work. Make sure MFA is enabled for this account. | New default administrator role assigned | false | https://msftriskyuser.authomize.com/incidents/ca1b9b775244e1dee0834e9c6a6acc816c4aad83 | Authomize_v2_CL | |||||||||||||||
| 251 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:46.273 AM | d944d6659d0ae6c4fa9c3b5d8e8a85c8a37b7e71 | 1/25/2023, 10:01:18.383 PM | 5/2/2023, 12:37:45.985 AM | [ { "id": "006b9b5e1cfc7d074c318be3080c86f7e362f045", "name": "All Sharepoint sites", "object": "asset", "originId": null, "originType": null }, { "id": "a536f7ea69a417200e5722a2373e6ffe8d3d147f", "name": "Steven Riley", "object": "identity", "email": null }, { "id": "3cbcaec94f6e10f6bd29da05adb4932cd246b496", "name": "Global Administrator", "object": "identity", "email": null } ] | [ { "id": "f0c8aa9c67004699b20c284c3cfa89f0de3078c7", "name": "Microsoft Active Directory - MSFT" } ] | Privileged Access | [ "Initial Access", "Persistence", "Privilege Escalation", "Defense Evasion", "Credential Access" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-03" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" } ] | [ "Cloud Service Discovery" ] | Open | High | 74705344818 | 74705344818 | User assigned to a default admin role | 74701857498 | Never use default administrative roles unless you have no other option. Make sure users with administrative roles have separate accounts for daily work. Make sure MFA is enabled for this account. | New default administrator role assigned | false | https://msftriskyuser.authomize.com/incidents/d944d6659d0ae6c4fa9c3b5d8e8a85c8a37b7e71 | Authomize_v2_CL | |||||||||||||||
| 252 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:48.224 AM | 791bf0246a04e89e2f334eb34d2142175c12ecda | 1/25/2023, 10:01:18.383 PM | 5/2/2023, 12:37:45.986 AM | [ { "id": "fe985b202df8f2b487cba173cf6200e0733e63ab", "name": "MSFT", "object": "asset", "originId": null, "originType": null }, { "id": "d1b1eb2c80b6b6101d51f156ffc08b9c632d5575", "name": "Microsoft.Azure.SyncFabric", "object": "identity", "email": null }, { "id": "9da7d2882c8e561a9bf2c898425a6426dd5fb0cb", "name": "Directory Readers", "object": "identity", "email": null } ] | [ { "id": "f0c8aa9c67004699b20c284c3cfa89f0de3078c7", "name": "Microsoft Active Directory - MSFT" } ] | Privileged Access | [ "Initial Access", "Persistence", "Privilege Escalation", "Defense Evasion", "Credential Access" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-03" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" } ] | [ "Cloud Service Discovery" ] | Open | High | 74705344818 | 74705344818 | User assigned to a default admin role | 74701857498 | Never use default administrative roles unless you have no other option. Make sure users with administrative roles have separate accounts for daily work. Make sure MFA is enabled for this account. | New default administrator role assigned | false | https://msftriskyuser.authomize.com/incidents/791bf0246a04e89e2f334eb34d2142175c12ecda | Authomize_v2_CL | |||||||||||||||
| 253 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:48.224 AM | b47b2341a5b1c7eee874c677f2d83f30f57b7113 | 1/25/2023, 10:01:18.383 PM | 5/2/2023, 12:37:45.987 AM | [ { "id": "f0c8aa9c67004699b20c284c3cfa89f0de3078c7", "name": "Microsoft Active Directory - MSFT", "object": "asset", "originId": null, "originType": null }, { "id": "d1b1eb2c80b6b6101d51f156ffc08b9c632d5575", "name": "Microsoft.Azure.SyncFabric", "object": "identity", "email": null }, { "id": "9da7d2882c8e561a9bf2c898425a6426dd5fb0cb", "name": "Directory Readers", "object": "identity", "email": null } ] | [ { "id": "f0c8aa9c67004699b20c284c3cfa89f0de3078c7", "name": "Microsoft Active Directory - MSFT" } ] | Privileged Access | [ "Initial Access", "Persistence", "Privilege Escalation", "Defense Evasion", "Credential Access" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-03" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" } ] | [ "Cloud Service Discovery" ] | Open | High | 74705344818 | 74705344818 | User assigned to a default admin role | 74701857498 | Never use default administrative roles unless you have no other option. Make sure users with administrative roles have separate accounts for daily work. Make sure MFA is enabled for this account. | New default administrator role assigned | false | https://msftriskyuser.authomize.com/incidents/b47b2341a5b1c7eee874c677f2d83f30f57b7113 | Authomize_v2_CL | |||||||||||||||
| 254 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:48.224 AM | def97cb4841dcfd9008a23e66fc3165e4564e746 | 1/25/2023, 10:01:18.383 PM | 5/2/2023, 12:37:45.987 AM | [ { "id": "1441bd5dcf06ddc16a2215fe005fd11365e9e3ce", "name": "Microsoft MSFT", "object": "asset", "originId": null, "originType": null }, { "id": "d1b1eb2c80b6b6101d51f156ffc08b9c632d5575", "name": "Microsoft.Azure.SyncFabric", "object": "identity", "email": null }, { "id": "9da7d2882c8e561a9bf2c898425a6426dd5fb0cb", "name": "Directory Readers", "object": "identity", "email": null } ] | [ { "id": "f0c8aa9c67004699b20c284c3cfa89f0de3078c7", "name": "Microsoft Active Directory - MSFT" } ] | Privileged Access | [ "Initial Access", "Persistence", "Privilege Escalation", "Defense Evasion", "Credential Access" ] | [ { "values": [ "6.8" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-03" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" } ] | [ "Cloud Service Discovery" ] | Open | High | 74705344818 | 74705344818 | User assigned to a default admin role | 74701857498 | Never use default administrative roles unless you have no other option. Make sure users with administrative roles have separate accounts for daily work. Make sure MFA is enabled for this account. | New default administrator role assigned | false | https://msftriskyuser.authomize.com/incidents/def97cb4841dcfd9008a23e66fc3165e4564e746 | Authomize_v2_CL | |||||||||||||||
| 255 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:48.224 AM | 7d7ca277b09a49538b46c2ae8216dba2d81e2a22 | 1/25/2023, 10:00:03.274 PM | 5/2/2023, 12:34:15.007 AM | [ { "id": "a536f7ea69a417200e5722a2373e6ffe8d3d147f", "name": "Steven Riley", "object": "identity", "email": null } ] | [ { "id": "f0c8aa9c67004699b20c284c3cfa89f0de3078c7", "name": "Microsoft Active Directory - MSFT" } ] | Misconfiguration | [ "Persistence", "Credential Access" ] | [ { "values": [ "IAM-02" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.3", "A.9.1.1", "A.7.2.2" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "IAM-02", "GRM-06" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [ "Account Manipulation" ] | Open | High | 74705345323 | 74705345323 | Admin password wasn't updated during the last 30 days | 74701857772 | Ensure that the password for this account is changed as soon as possible Consider suspending this account until the password is changed Enforce strong password policies within your organization | Admin User Steven Riley hasn't changed their password for Microsoft in 31 days. Our security policy requires users to switch passwords every 30 days. | false | https://msftriskyuser.authomize.com/incidents/7d7ca277b09a49538b46c2ae8216dba2d81e2a22 | Authomize_v2_CL | |||||||||||||||
| 256 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:48.224 AM | a283d40c2fad4489bafb497bbf988f663b4786d6 | 1/25/2023, 9:59:58.826 PM | 5/2/2023, 12:33:29.706 AM | [ { "id": "7c8d752e5c52030a944df0df48ba7f094e4a13ea", "name": "Lynne Robbins", "object": "identity", "email": null } ] | [ { "id": "f0c8aa9c67004699b20c284c3cfa89f0de3078c7", "name": "Microsoft Active Directory - MSFT" } ] | Misconfiguration | [ "Credential Access", "Initial Access", "Privilege Escalation" ] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-14", "DSP-07", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.2", "A.9.1.2", "A.9.2.2", "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-01", "IAM-02", "IAM-05" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [ "Valid Accounts", "Account Manipulation" ] | Open | High | 74705347364 | 74705347364 | User without MFA | 74701857084 | Ensure that Lynne Robbins enables MFA. | ActiveDirectory user Lynne Robbins has no multi factor authentication (MFA) set up. | false | https://msftriskyuser.authomize.com/incidents/a283d40c2fad4489bafb497bbf988f663b4786d6 | Authomize_v2_CL | |||||||||||||||
| 257 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:48.224 AM | bd9d2b55727089e9052f600e1c8c0910e550601e | 1/25/2023, 9:59:58.826 PM | 5/2/2023, 12:33:29.706 AM | [ { "id": "acbd18c67a6f20b899b841c6dab221a6de46e8d4", "name": "Megan Bowen", "object": "identity", "email": null } ] | [ { "id": "f0c8aa9c67004699b20c284c3cfa89f0de3078c7", "name": "Microsoft Active Directory - MSFT" } ] | Misconfiguration | [ "Credential Access", "Initial Access", "Privilege Escalation" ] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-14", "DSP-07", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.2", "A.9.1.2", "A.9.2.2", "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-01", "IAM-02", "IAM-05" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [ "Valid Accounts", "Account Manipulation" ] | Open | High | 74705347364 | 74705347364 | User without MFA | 74701857084 | Ensure that Megan Bowen enables MFA. | ActiveDirectory user Megan Bowen has no multi factor authentication (MFA) set up. | false | https://msftriskyuser.authomize.com/incidents/bd9d2b55727089e9052f600e1c8c0910e550601e | Authomize_v2_CL | |||||||||||||||
| 258 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:48.224 AM | c16dd125bf3ce6880c187660ccb7eb88ae7add3f | 1/25/2023, 9:59:58.826 PM | 5/2/2023, 12:33:29.706 AM | [ { "id": "bdf9f09ae1a208bfbffcea454d32ad881a3cd43e", "name": "Diego Siciliani", "object": "identity", "email": null } ] | [ { "id": "f0c8aa9c67004699b20c284c3cfa89f0de3078c7", "name": "Microsoft Active Directory - MSFT" } ] | Misconfiguration | [ "Credential Access", "Initial Access", "Privilege Escalation" ] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-14", "DSP-07", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.2", "A.9.1.2", "A.9.2.2", "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-01", "IAM-02", "IAM-05" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [ "Valid Accounts", "Account Manipulation" ] | Open | High | 74705347364 | 74705347364 | User without MFA | 74701857084 | Ensure that Diego Siciliani enables MFA. | ActiveDirectory user Diego Siciliani has no multi factor authentication (MFA) set up. | false | https://msftriskyuser.authomize.com/incidents/c16dd125bf3ce6880c187660ccb7eb88ae7add3f | Authomize_v2_CL | |||||||||||||||
| 259 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:48.224 AM | e0d6de2de03a2be14b3d38d5adb60561c85ec883 | 1/25/2023, 9:59:58.826 PM | 5/2/2023, 12:33:29.706 AM | [ { "id": "a23936673c0d36558ce94dff5ddabd34ef59b152", "name": "Patti Fernandez", "object": "identity", "email": null } ] | [ { "id": "f0c8aa9c67004699b20c284c3cfa89f0de3078c7", "name": "Microsoft Active Directory - MSFT" } ] | Misconfiguration | [ "Credential Access", "Initial Access", "Privilege Escalation" ] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-14", "DSP-07", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.2", "A.9.1.2", "A.9.2.2", "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-01", "IAM-02", "IAM-05" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [ "Valid Accounts", "Account Manipulation" ] | Open | High | 74705347364 | 74705347364 | User without MFA | 74701857084 | Ensure that Patti Fernandez enables MFA. | ActiveDirectory user Patti Fernandez has no multi factor authentication (MFA) set up. | false | https://msftriskyuser.authomize.com/incidents/e0d6de2de03a2be14b3d38d5adb60561c85ec883 | Authomize_v2_CL | |||||||||||||||
| 260 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:48.224 AM | ea2f842f45228af455568e9446c6ae1c37a3e28c | 1/25/2023, 9:59:58.826 PM | 5/2/2023, 12:33:29.706 AM | [ { "id": "9e35b3ab6003b6ac5c4c82e5cfe849a313cab903", "name": "Miriam Graham", "object": "identity", "email": null } ] | [ { "id": "f0c8aa9c67004699b20c284c3cfa89f0de3078c7", "name": "Microsoft Active Directory - MSFT" } ] | Misconfiguration | [ "Credential Access", "Initial Access", "Privilege Escalation" ] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-14", "DSP-07", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.2", "A.9.1.2", "A.9.2.2", "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-01", "IAM-02", "IAM-05" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [ "Valid Accounts", "Account Manipulation" ] | Open | High | 74705347364 | 74705347364 | User without MFA | 74701857084 | Ensure that Miriam Graham enables MFA. | ActiveDirectory user Miriam Graham has no multi factor authentication (MFA) set up. | false | https://msftriskyuser.authomize.com/incidents/ea2f842f45228af455568e9446c6ae1c37a3e28c | Authomize_v2_CL | |||||||||||||||
| 261 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:48.224 AM | 001736552de678d924874ac865da73aafc9d5d69 | 1/25/2023, 9:59:58.825 PM | 5/2/2023, 12:33:29.706 AM | [ { "id": "8789cf5311bad67ea167df127e204ae2971c2c80", "name": "Isaiah Langer", "object": "identity", "email": null } ] | [ { "id": "f0c8aa9c67004699b20c284c3cfa89f0de3078c7", "name": "Microsoft Active Directory - MSFT" } ] | Misconfiguration | [ "Credential Access", "Initial Access", "Privilege Escalation" ] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-14", "DSP-07", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.2", "A.9.1.2", "A.9.2.2", "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-01", "IAM-02", "IAM-05" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [ "Valid Accounts", "Account Manipulation" ] | Open | High | 74705347364 | 74705347364 | User without MFA | 74701857084 | Ensure that Isaiah Langer enables MFA. | ActiveDirectory user Isaiah Langer has no multi factor authentication (MFA) set up. | false | https://msftriskyuser.authomize.com/incidents/001736552de678d924874ac865da73aafc9d5d69 | Authomize_v2_CL | |||||||||||||||
| 262 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:48.979 AM | 17c9523e33590f36546b3175fe4be725415f2925 | 1/25/2023, 9:59:58.825 PM | 5/2/2023, 12:33:29.707 AM | [ { "id": "5eaf5a4260b54dcfbd22def9e70ab1ad263cccb2", "name": "Adele Vance", "object": "identity", "email": null } ] | [ { "id": "f0c8aa9c67004699b20c284c3cfa89f0de3078c7", "name": "Microsoft Active Directory - MSFT" } ] | Misconfiguration | [ "Credential Access", "Initial Access", "Privilege Escalation" ] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-14", "DSP-07", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.2", "A.9.1.2", "A.9.2.2", "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-01", "IAM-02", "IAM-05" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [ "Valid Accounts", "Account Manipulation" ] | Open | High | 74705347364 | 74705347364 | User without MFA | 74701857084 | Ensure that Adele Vance enables MFA. | ActiveDirectory user Adele Vance has no multi factor authentication (MFA) set up. | false | https://msftriskyuser.authomize.com/incidents/17c9523e33590f36546b3175fe4be725415f2925 | Authomize_v2_CL | |||||||||||||||
| 263 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:48.979 AM | 1edba095152ca93979b0293b47d8e01fc125a8d1 | 1/25/2023, 9:59:58.825 PM | 5/2/2023, 12:33:29.705 AM | [ { "id": "1c8446770bbe4e3df4f98407dbf5c252d289039e", "name": "Pradeep Gupta", "object": "identity", "email": null } ] | [ { "id": "f0c8aa9c67004699b20c284c3cfa89f0de3078c7", "name": "Microsoft Active Directory - MSFT" } ] | Misconfiguration | [ "Credential Access", "Initial Access", "Privilege Escalation" ] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-14", "DSP-07", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.2", "A.9.1.2", "A.9.2.2", "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-01", "IAM-02", "IAM-05" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [ "Valid Accounts", "Account Manipulation" ] | Open | High | 74705347364 | 74705347364 | User without MFA | 74701857084 | Ensure that Pradeep Gupta enables MFA. | ActiveDirectory user Pradeep Gupta has no multi factor authentication (MFA) set up. | false | https://msftriskyuser.authomize.com/incidents/1edba095152ca93979b0293b47d8e01fc125a8d1 | Authomize_v2_CL | |||||||||||||||
| 264 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:48.979 AM | 2098609eac99b2d74f34d273f383e29c65087f70 | 1/25/2023, 9:59:58.825 PM | 5/2/2023, 12:33:29.705 AM | [ { "id": "51c4d0dd2a5c22a8d5f4bd9370a2b79fa13bef15", "name": "Alex Wilber", "object": "identity", "email": null } ] | [ { "id": "f0c8aa9c67004699b20c284c3cfa89f0de3078c7", "name": "Microsoft Active Directory - MSFT" } ] | Misconfiguration | [ "Credential Access", "Initial Access", "Privilege Escalation" ] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-14", "DSP-07", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.2", "A.9.1.2", "A.9.2.2", "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-01", "IAM-02", "IAM-05" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [ "Valid Accounts", "Account Manipulation" ] | Open | High | 74705347364 | 74705347364 | User without MFA | 74701857084 | Ensure that Alex Wilber enables MFA. | ActiveDirectory user Alex Wilber has no multi factor authentication (MFA) set up. | false | https://msftriskyuser.authomize.com/incidents/2098609eac99b2d74f34d273f383e29c65087f70 | Authomize_v2_CL | |||||||||||||||
| 265 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:48.979 AM | 26814b852913c416607fd3f323d48dc80dd1f790 | 1/25/2023, 9:59:58.825 PM | 5/2/2023, 12:33:29.706 AM | [ { "id": "f8675b4257c1c9dce9001ebd2a0825fb167c5c04", "name": "Johanna Lorenz", "object": "identity", "email": null } ] | [ { "id": "f0c8aa9c67004699b20c284c3cfa89f0de3078c7", "name": "Microsoft Active Directory - MSFT" } ] | Misconfiguration | [ "Credential Access", "Initial Access", "Privilege Escalation" ] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-14", "DSP-07", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.2", "A.9.1.2", "A.9.2.2", "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-01", "IAM-02", "IAM-05" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [ "Valid Accounts", "Account Manipulation" ] | Open | High | 74705347364 | 74705347364 | User without MFA | 74701857084 | Ensure that Johanna Lorenz enables MFA. | ActiveDirectory user Johanna Lorenz has no multi factor authentication (MFA) set up. | false | https://msftriskyuser.authomize.com/incidents/26814b852913c416607fd3f323d48dc80dd1f790 | Authomize_v2_CL | |||||||||||||||
| 266 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:48.979 AM | 88629e8ba4f1b0cf0b73ffcbd683ff26f4727485 | 1/25/2023, 9:59:58.825 PM | 5/2/2023, 12:33:29.706 AM | [ { "id": "8a056177e503b0ede592115fccc136ceae683c7b", "name": "Grady Archie", "object": "identity", "email": null } ] | [ { "id": "f0c8aa9c67004699b20c284c3cfa89f0de3078c7", "name": "Microsoft Active Directory - MSFT" } ] | Misconfiguration | [ "Credential Access", "Initial Access", "Privilege Escalation" ] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-14", "DSP-07", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.2", "A.9.1.2", "A.9.2.2", "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-01", "IAM-02", "IAM-05" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [ "Valid Accounts", "Account Manipulation" ] | Open | High | 74705347364 | 74705347364 | User without MFA | 74701857084 | Ensure that Grady Archie enables MFA. | ActiveDirectory user Grady Archie has no multi factor authentication (MFA) set up. | false | https://msftriskyuser.authomize.com/incidents/88629e8ba4f1b0cf0b73ffcbd683ff26f4727485 | Authomize_v2_CL | |||||||||||||||
| 267 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:48.979 AM | f06936273878410c3066c30f7f428ec590fa223d | 1/25/2023, 9:59:58.825 PM | 5/2/2023, 12:33:29.706 AM | [ { "id": "a43f28ae7266ddbe95a3dedacebc1d75d7ed0521", "name": "Lidia Holloway", "object": "identity", "email": null } ] | [ { "id": "f0c8aa9c67004699b20c284c3cfa89f0de3078c7", "name": "Microsoft Active Directory - MSFT" } ] | Misconfiguration | [ "Credential Access", "Initial Access", "Privilege Escalation" ] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-14", "DSP-07", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.2", "A.9.1.2", "A.9.2.2", "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-01", "IAM-02", "IAM-05" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [ "Valid Accounts", "Account Manipulation" ] | Open | High | 74705347364 | 74705347364 | User without MFA | 74701857084 | Ensure that Lidia Holloway enables MFA. | ActiveDirectory user Lidia Holloway has no multi factor authentication (MFA) set up. | false | https://msftriskyuser.authomize.com/incidents/f06936273878410c3066c30f7f428ec590fa223d | Authomize_v2_CL | |||||||||||||||
| 268 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:48.979 AM | 0c9da8f1e9cde31d4f64b4e83c397334a61720ca | 1/25/2023, 9:59:58.825 PM | 5/2/2023, 12:33:29.707 AM | [ { "id": "2f4dc86237b061798aac6ad2aa28a2172235f57d", "name": "Lee Gu", "object": "identity", "email": null } ] | [ { "id": "f0c8aa9c67004699b20c284c3cfa89f0de3078c7", "name": "Microsoft Active Directory - MSFT" } ] | Misconfiguration | [ "Credential Access", "Initial Access", "Privilege Escalation" ] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-14", "DSP-07", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.2", "A.9.1.2", "A.9.2.2", "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-01", "IAM-02", "IAM-05" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [ "Valid Accounts", "Account Manipulation" ] | Open | High | 74705347364 | 74705347364 | User without MFA | 74701857084 | Ensure that Lee Gu enables MFA. | ActiveDirectory user Lee Gu has no multi factor authentication (MFA) set up. | false | https://msftriskyuser.authomize.com/incidents/0c9da8f1e9cde31d4f64b4e83c397334a61720ca | Authomize_v2_CL | |||||||||||||||
| 269 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:48.979 AM | 3eccb23151bbc83e7d6cf869e8d249350320adef | 1/25/2023, 9:59:58.825 PM | 5/2/2023, 12:33:29.707 AM | [ { "id": "b7fa3acc7b77a24339605577446a5cf103fb2c00", "name": "Henrietta Mueller", "object": "identity", "email": null } ] | [ { "id": "f0c8aa9c67004699b20c284c3cfa89f0de3078c7", "name": "Microsoft Active Directory - MSFT" } ] | Misconfiguration | [ "Credential Access", "Initial Access", "Privilege Escalation" ] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-14", "DSP-07", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.2", "A.9.1.2", "A.9.2.2", "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-01", "IAM-02", "IAM-05" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [ "Valid Accounts", "Account Manipulation" ] | Open | High | 74705347364 | 74705347364 | User without MFA | 74701857084 | Ensure that Henrietta Mueller enables MFA. | ActiveDirectory user Henrietta Mueller has no multi factor authentication (MFA) set up. | false | https://msftriskyuser.authomize.com/incidents/3eccb23151bbc83e7d6cf869e8d249350320adef | Authomize_v2_CL | |||||||||||||||
| 270 | 368f4943-db69-4ede-8c31-1788dc4e2dc3 | RestAPI | 5/2/2023, 2:16:48.979 AM | 99ef59e4aa23e9aa3fe17a5bc2cafaf28191b3f4 | 1/25/2023, 9:59:58.825 PM | 5/2/2023, 12:33:29.707 AM | [ { "id": "2f4dc86237b061798aac6ad2aa28a2172235f57d", "name": "Lee Gu", "object": "identity", "email": null } ] | [ { "id": "f0c8aa9c67004699b20c284c3cfa89f0de3078c7", "name": "Microsoft Active Directory - MSFT" } ] | Misconfiguration | [ "Credential Access", "Initial Access", "Privilege Escalation" ] | [ { "values": [ "12.7", "6.5" ], "id": "cisv8", "name": "CIS v.8" }, { "values": [ "IAM-01", "IAM-14", "DSP-07", "IAM-16" ], "id": "ccm402", "name": "CSA STAR (CCM 4.0.2)" }, { "values": [ "A.9.4.2", "A.9.1.2", "A.9.2.2", "A.9.2.3" ], "id": "isoIec27001", "name": "ISO/IEC 27001" }, { "values": [ "CC6.2" ], "id": "aicpaTsc2017", "name": "SOC 2 (TSC 2017)" }, { "values": [ "IAM-01", "IAM-02", "IAM-05" ], "id": "ccm301", "name": "CSA STAR (CCM 3.0.1)" } ] | [ "Valid Accounts", "Account Manipulation" ] | Open | High | 74705347364 | 74705347364 | User without MFA | 74701857084 | Ensure that Joni Sherman enables MFA. | ActiveDirectory user Joni Sherman has no multi factor authentication (MFA) set up. | false | https://msftriskyuser.authomize.com/incidents/99ef59e4aa23e9aa3fe17a5bc2cafaf28191b3f4 | Authomize_v2_CL |