From 77b300ab4e66b9dbd0d3cc3ed741411ae2f9bd2a Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 15 Feb 2022 09:37:52 -0800
Subject: [PATCH] Accidentally changed detection file
 detections/cloud/aws_excessive_security_scanning.yml. That file should not
 have been modified.  Rolling back those changes.

---
 detections/cloud/aws_excessive_security_scanning.yml | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/detections/cloud/aws_excessive_security_scanning.yml b/detections/cloud/aws_excessive_security_scanning.yml
index 97829915ef..8d8d5bcc48 100644
--- a/detections/cloud/aws_excessive_security_scanning.yml
+++ b/detections/cloud/aws_excessive_security_scanning.yml
@@ -9,12 +9,11 @@ description: This search looks for AWS CloudTrail events and analyse the amount
   eventNames which starts with Describe by a single user. This indicates that this
   user scans the configuration of your AWS cloud environment.
 search: '
-  `o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=failure
-  | stats count earliest(_time) as firstTime latest(_time) values(UserAuthenticationMethod) AS UserAuthenticationMethod values(UserAgent) AS UserAgent values(status) AS status values(src_ip) AS src_ip by user 
-  | where count > 10 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `o365_excessive_authentication_failures_alert_filter`'
+  `cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get*  |
+  stats dc(eventName) as dc_events min(_time) as firstTime max(_time) as lastTime
+  values(eventName) as eventName values(src) as src values(userAgent) as userAgent
+  by user userIdentity.arn | where dc_events > 50 | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`|`aws_excessive_security_scanning_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
   search works with AWS CloudTrail logs.
 known_false_positives: While this search has no known false positives.