admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inDetect New Open S3 Buckets over AWS CLI

Browse Source
This commit is contained in:
root
2021-07-28 18:19:22 +00:00
parent ea8de7ad52
commit 2fac7f3a74
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml
+4 -3
View File
@@ -7,7 +7,8 @@ type: batch
datamodel: []
description: This search looks for AWS CloudTrail events where a user has created
an open/public S3 bucket over the aws cli.
search: '`cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp
search: '`cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli*
) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp
IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write
IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp
IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control
@@ -41,8 +42,8 @@ tags:
impact: 60
kill_chain_phases:
- Actions on Objectives
message: User $userIdentity.userName$ has created an open/public bucket $bucketName$ using AWS CLI
with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$
message: User $userIdentity.userName$ has created an open/public bucket $bucketName$
using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$
$requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$
$requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$
mitre_attack_id: