Create Account

MITRE ATT&CK Content

A threat actor using credentials with appropriate permissions is able to create an account within an AWS organization that will use the payment method registered to the management or payer account. The theat actor will then be able to create resources and workloads within the newly created account that may not be subject to existing detections. By default, Service Control Policies are not assigned to new accounts during the creation of the account within an organization.