LoFP / rare and unusual errors may indicate an impending service failure state. rare and unusual user error activity can also be due to manual troubleshooting or reconfiguration attempts by insufficiently privileged users, bugs in cloud automation scripts or workflows, or changes to iam privileges.

Techniques

• T1526
• T1580

Sample rules

Rare AWS Error Code

• source: elastic
• technicques:
  • T1526
  • T1580

Description

A machine learning job detected an unusual error in a CloudTrail message. These can be byproducts of attempted or successful persistence, privilege escalation, defense evasion, discovery, lateral movement, or collection.

Detection logic