From 79af6768570e94becb250f87dfa0f45850aaf177 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 27 Jul 2021 16:45:59 -0700 Subject: [PATCH 1/2] Update detect_new_open_s3_buckets_over_aws_cli.yml --- detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml index 9d15b97e51..4a1bf833ff 100644 --- a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml +++ b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml @@ -7,7 +7,7 @@ type: batch datamodel: [] description: This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. -search: '`cloudtrail` eventSource="s3.amazonaws.com" userAgent=[aws-cli* OR userAgent=aws-cli* eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp +search: '`cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* )eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control From 74e02663410603ea2d1132560c5ab76e9ffbb8d9 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 27 Jul 2021 16:50:03 -0700 Subject: [PATCH 2/2] Update detect_new_open_s3_buckets_over_aws_cli.yml --- detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml index 4a1bf833ff..2b76f5e55c 100644 --- a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml +++ b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml @@ -7,7 +7,7 @@ type: batch datamodel: [] description: This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. -search: '`cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* )eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp +search: '`cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control