Description

Orca detected that a new AWS user was created from a tor IP address - {MaliciousIp.MaliciousIp}, the operation was successful. This action may indicate of a presence of an unauthorized actor in the cloud environment. An attacker with an initial foothold, might try to create a new user to ensure a persistence access to the cloud environment.