admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

new detections for test plan

Browse Source
This commit is contained in:
Bhavin Patel
2024-07-10 12:41:54 -07:00
parent c3088d0852
commit 01d534add7
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/aws_createaccesskey.yml
+1 -1
View File
@@ -5,7 +5,7 @@ date: '2024-05-12'
author: Bhavin Patel, Splunk
status: production
type: Hunting
description: The following analytic identifies the creation of AWS IAM access keys
description: This change was made in Github - The following analytic identifies the creation of AWS IAM access keys
by a user for another user, which can indicate privilege escalation. It leverages
AWS CloudTrail logs to detect instances where the user creating the access key is
different from the user for whom the key is created. This activity is significant
detections/cloud/aws_createloginprofile.yml
+1 -1
View File
@@ -5,7 +5,7 @@ date: '2024-05-16'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic identifies the creation of a login profile for
description: This change was made in Github - The following analytic identifies the creation of a login profile for
one AWS user by another, followed by a console login from the same source IP. It
uses AWS CloudTrail logs to correlate the `CreateLoginProfile` and `ConsoleLogin`
events based on the source IP and user identity. This activity is significant as