CreateAccessEntry

CSP: AWS

Tactics:

Persistence Privilege Escalation

Techniques:

T1136.003T1098

Tags:

AWS EKS

Event

Creates an access entry for an EKS cluster, granting an IAM principal Kubernetes API access via EKS access management.

Security Context

• Account manipulation is a primary persistence technique, allowing adversaries to maintain access through modified permissions or credentials.
• Creating cloud accounts provides a durable backdoor that persists independently of any compromised user’s credentials.

Log Source

CloudTrail

Sample Event

MITRE ATT&CK Mapping

Tactics: Persistence Privilege Escalation

Techniques:

• T1136.003 — Cloud Account — Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.
• T1098 — Account Manipulation — Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.