From a4e1a402cafc0477a3761e64bf77907eb8563b6f Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 28 Jul 2020 12:03:21 -0400 Subject: [PATCH] anothererrorfixed --- detections/aws_detect_permanent_key_creation.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/aws_detect_permanent_key_creation.yml b/detections/aws_detect_permanent_key_creation.yml index 32b448b4ec..a001ce279b 100644 --- a/detections/aws_detect_permanent_key_creation.yml +++ b/detections/aws_detect_permanent_key_creation.yml @@ -4,7 +4,7 @@ description: "This search provides detection of accounts creating permanent keys how_to_implement: "You must install splunk AWS add on and Splunk App for AWS. This search works with cloudwatch logs" id: 12d6d713-3cb4-4ffc-a064-1dca3d1cca01 known_false_positives: "Not all permanent key creations are malicious. If there is a policy of rotating keys this search can be adjusted to provide better context." -name: "aws detect permament key creation" +name: "aws detect permanent key creation" references: [] search: '`aws_cloudwatchlogs_eks` AKIA | spath eventName | search eventName=CreateAccessKey "userIdentity.type!=AssumedRole" | table sourceIPAddress userName src_user userIdentity.type userAgent action status responseElements.accessKey.createDate responseElements.accessKey.status responseElements.accessKey.accessKeyId |`aws_detect_permanent_key_creation_filter`'