elastic-detection-rules

mirror of https://github.com/elastic/detection-rules synced 2026-06-08 14:00:08 +00:00

Files

T

Terrance DeJesus 66701ff663 [New Rule] Adding Coverage for AWS IAM or STS API Calls via Temporary Session Tokens (#4628 )

* adding new rule 'AWS IAM or STS API Calls via Temporary Session Tokens'

* updated name and query logic

* updated query logic

* changed rule to new terms

* fixed logic

* Update rules/integrations/aws/persistence_iam_sts_api_calls_via_user_session_token.toml

* Update rules/integrations/aws/persistence_iam_sts_api_calls_via_user_session_token.toml

* updated investigation guide; scoped to IAM only; updated naming

* updating file name

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

(cherry picked from commit f02ccfef64)

2025-04-24 19:44:16 +00:00

aws

[New Rule] Adding Coverage for AWS IAM or STS API Calls via Temporary Session Tokens (#4628 )

2025-04-24 19:44:16 +00:00

aws_bedrock

Prep for Release 9.0 (#4550 )

2025-03-20 15:07:35 +00:00

azure

[New] Suspicious Azure Sign-in via Visual Studio Code (#4639 )

2025-04-23 13:10:57 +00:00

azure_openai

Add investigation guides (#4600 )