You are investigating IOAs found in your cloud environment after a security breach.

InCrowdStrike Falcon Cloud Security, IOAs are categorized usingMITRE ATT&CK-aligned tacticsto help analysts quickly identify attacker objectives. When investigating how a threat actor may havemaintained accessto cloud resources after an initial breach, the appropriate tactic to focus on isPersistence.

Persistence IOAs represent techniques such as creating backdoor IAM roles, modifying access policies, adding API keys, enabling long-lived credentials, or altering cloud configurations to survive reboots or credential rotation. Filtering the IOA dashboard byPersistenceisolates these behaviors, enabling faster root-cause analysis and remediation.

Other filters serve different investigative purposes. Execution focuses on initial code execution, Privilege Escalation highlights elevation of permissions, and Ransomware identifies encryption-related activity. None of these specifically address long-term access maintenance.

Therefore, filtering byPersistenceis the correct and most effective way to identify IOAs related to maintaining access within cloud environments.