From 01d534add7d2d760dfb2faac32ab1ad336acceaf Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 10 Jul 2024 12:41:54 -0700 Subject: [PATCH] new detections for test plan --- detections/cloud/aws_createaccesskey.yml | 2 +- detections/cloud/aws_createloginprofile.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/cloud/aws_createaccesskey.yml b/detections/cloud/aws_createaccesskey.yml index f9bc4065ea..1fe4662d26 100644 --- a/detections/cloud/aws_createaccesskey.yml +++ b/detections/cloud/aws_createaccesskey.yml @@ -5,7 +5,7 @@ date: '2024-05-12' author: Bhavin Patel, Splunk status: production type: Hunting -description: The following analytic identifies the creation of AWS IAM access keys +description: This change was made in Github - The following analytic identifies the creation of AWS IAM access keys by a user for another user, which can indicate privilege escalation. It leverages AWS CloudTrail logs to detect instances where the user creating the access key is different from the user for whom the key is created. This activity is significant diff --git a/detections/cloud/aws_createloginprofile.yml b/detections/cloud/aws_createloginprofile.yml index ab82917ec6..14cfded3ec 100644 --- a/detections/cloud/aws_createloginprofile.yml +++ b/detections/cloud/aws_createloginprofile.yml @@ -5,7 +5,7 @@ date: '2024-05-16' author: Bhavin Patel, Splunk status: production type: TTP -description: The following analytic identifies the creation of a login profile for +description: This change was made in Github - The following analytic identifies the creation of a login profile for one AWS user by another, followed by a console login from the same source IP. It uses AWS CloudTrail logs to correlate the `CreateLoginProfile` and `ConsoleLogin` events based on the source IP and user identity. This activity is significant as