Skip to content
Threat Feed

Tag

Policy

7 briefs RSS
medium advisory

Okta Policy Rule Modification or Deletion

An Okta policy rule was modified or deleted, potentially weakening security controls.

Okta identity policy attack.impact
2r 1t
high advisory

S3Browser IAM Policy Creation with Default Bucket Name

An AWS IAM policy is created by the S3Browser utility with the default S3 bucket name placeholder, potentially indicating unauthorized access or misconfiguration.

AWS IAM +1 aws iam s3browser s3 policy cloudtrail
2r 3t
high advisory

AWS Policy Created Allowing All Resources

An AWS IAM policy version was created that allows all actions on all resources, potentially leading to privilege escalation or unauthorized access.

AWS IAM aws iam policy privilege-escalation
2r 1t
low advisory

Okta Policy Modification or Deletion Detected

An Okta policy was modified or deleted, potentially indicating unauthorized changes to security configurations within the Okta identity management platform by a malicious actor or insider.

Okta Identity Cloud identity okta policy attack.impact
2r 1t
high threat

Malicious Use of Microsoft Intune Device Management Configuration Policies

Attackers can abuse Microsoft Intune device management configuration policies, typically used for legitimate remote device management, to disable defenses and evade detection on managed devices.

exploited Intune azure device_management policy defense_evasion
2r 3t
medium advisory

AWS IAM Policy Deletion Detection

Detection of AWS IAM policy deletion events, which could indicate malicious activity by a compromised account or insider threat.

AWS IAM aws iam policy cloudtrail
2r 1t
medium advisory

AWS IAM Default Policy Version Modification

An adversary modifies the default version of an AWS IAM policy, potentially downgrading security or disrupting access control.

AWS Identity and Access Management aws iam policy
2r 1t