mirror of
https://github.com/OTRF/OSSEM-DM
synced 2026-06-08 12:05:55 +00:00
Jose Rodriguez
24 lines
563 B
YAML
24 lines
563 B
YAML
relationship_id: REL-2022-0005
|
|
name: User modified
|
|
contributors:
|
|
- Jose Rodriguez @Cyb3rPandaH
|
|
attack: null
|
|
behavior:
|
|
source: user
|
|
relationship: modified
|
|
target: null
|
|
security_events:
|
|
- event_id: cloudtrail
|
|
name: cloudtrail
|
|
platform: aws
|
|
log_source: cloudtrail
|
|
filter_in:
|
|
- eventName: PasswordUpdated
|
|
- eventType: AwsConsoleSignin
|
|
event_version:
|
|
- '1.05'
|
|
references:
|
|
- https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-non-api-events.html
|
|
notes:
|
|
- Potential contribution for ATT&CK - User Account / user account metadata
|