Can you find role chaining via cloudtrail logs and track who initiated the evrntd.. e..g use assumes role and then role assumes another role. i think sessionissuer tracks this and can be attributed
Analyzing Tumor Growth
I've been focusing on the rapid multiplication of the tumors, noticing the consistent trend. Now I'm considering potential influences: perhaps some downstream effect or a cyclical nature.
Examining Tumor Behavior
| { | |
| "name": "layer", | |
| "versions": { | |
| "attack": "8", | |
| "navigator": "4.0", | |
| "layer": "4.0" | |
| }, | |
| "domain": "enterprise-attack", | |
| "description": "", | |
| "filters": { |
| { | |
| "description": "AWS ATT&CK Matrix Coverage for Azure Sentinel", | |
| "name": "AWS Layer Json File for Azure Sentinel", | |
| "domain": "mitre-enterprise", | |
| "version": "3.0", | |
| "filters": { | |
| "stages": [ | |
| "act" | |
| ], | |
| "platforms": [ |
| { | |
| "description": "AWS ATT&CK Matrix Coverage for Azure Sentinel", | |
| "name": "AWS Layer Json File for Azure Sentinel", | |
| "domain": "mitre-enterprise", | |
| "version": "3.0", | |
| "filters": { | |
| "stages": [ | |
| "act" | |
| ], | |
| "platforms": [ |