admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'blackbolt_duplicate' of github.com:splunk/security_content into blackbolt_duplicate

Browse Source
This commit is contained in:
patel-bhavin
2021-07-28 10:52:39 -07:00
parent ecf2886c43 74e0266341
commit ea8de7ad52
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml
+1 -1
View File
@@ -7,7 +7,7 @@ type: batch
datamodel: []
description: This search looks for AWS CloudTrail events where a user has created
an open/public S3 bucket over the aws cli.
search: '`cloudtrail` eventSource="s3.amazonaws.com" userAgent=[aws-cli* OR userAgent=aws-cli* eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp
search: '`cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp
IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write
IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp
IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control