admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update aws_detect_sts_assume_role_abuse.yml

Browse Source 
using cloudtrail as input macro
This commit is contained in:
Bhavin Patel
2020-09-10 13:25:39 -07:00
committed by GitHub
parent 5e9f3a7ae0
commit ef3fee0a81
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/aws_detect_sts_assume_role_abuse.yml
+1 -1
View File
@@ -6,7 +6,7 @@ id: 8e565314-b6a2-46d8-9f05-1a34a176a662
known_false_positives: "Sts:AssumeRole can be very noisy as it is a standard mechanism to provide cross account and cross resources access. This search can be adjusted to provide specific values to identify cases of abuse."
name: "aws detect sts assume role abuse"
references: []
search: '`aws_cloudwatchlogs_eks` user_type=AssumedRole userIdentity.sessionContext.sessionIssuer.type=Role | table sourceIPAddress userIdentity.arn user_agent user_access_key status action requestParameters.roleName responseElements.role.roleName responseElements.role.createDate | `aws_detect_sts_assume_role_abuse_filter`'
search: '`cloudtrail` user_type=AssumedRole userIdentity.sessionContext.sessionIssuer.type=Role | table sourceIPAddress userIdentity.arn user_agent user_access_key status action requestParameters.roleName responseElements.role.roleName responseElements.role.createDate | `aws_detect_sts_assume_role_abuse_filter`'
tags:
analytics_story:
- "AWS Cross Account Activity"