Product
ECS
- First Reported
- Dec 20, 2024
- Latest Reported
- Jan 15, 2025
Reported Context (2)
- These actions are followed by a call to the ECS API CreateCluster attempting to create a cluster with the name bapak1. Fortunately, in the incidents we observed the attacker lacked the permissions required to actually Wiz Uses Behavioral Cloud IOCs to Track Credential-Abusing Actors
- Container services on AWS, such as ECS and EKS, use the environment variable AWS_CONTAINER_CREDENTIALS_RELATIVE_URI along with the IP address 169.254.170.2 to perform an HTTP GET to a URL such as How AWS Services Provide Credentials—and Where Attackers May Find Them
People (2)
Threat Actors (2)
MITRE ATT&CK (7)
Vendors (2)
Products (15)
Tools (2)
Countries (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.