admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

anothererrorfixed

Browse Source
This commit is contained in:
Rod Soto
2020-07-28 12:03:21 -04:00
parent d597c6f64c
commit a4e1a402ca
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/aws_detect_permanent_key_creation.yml
+1 -1
View File
@@ -4,7 +4,7 @@ description: "This search provides detection of accounts creating permanent keys
how_to_implement: "You must install splunk AWS add on and Splunk App for AWS. This search works with cloudwatch logs"
id: 12d6d713-3cb4-4ffc-a064-1dca3d1cca01
known_false_positives: "Not all permanent key creations are malicious. If there is a policy of rotating keys this search can be adjusted to provide better context."
name: "aws detect permament key creation"
name: "aws detect permanent key creation"
references: []
search: '`aws_cloudwatchlogs_eks` AKIA | spath eventName | search eventName=CreateAccessKey "userIdentity.type!=AssumedRole" | table sourceIPAddress userName src_user userIdentity.type userAgent action status responseElements.accessKey.createDate responseElements.accessKey.status responseElements.accessKey.accessKeyId
|`aws_detect_permanent_key_creation_filter`'