From f79866dca4084cb71b5e22bdadf93ebbcaf267e5 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 8 Mar 2022 09:24:18 -0800 Subject: [PATCH] Update aws_updateloginprofile.yml --- detections/cloud/aws_updateloginprofile.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/aws_updateloginprofile.yml b/detections/cloud/aws_updateloginprofile.yml index 85c4b772b2..f631278fd9 100644 --- a/detections/cloud/aws_updateloginprofile.yml +++ b/detections/cloud/aws_updateloginprofile.yml @@ -11,7 +11,7 @@ description: This search looks for AWS CloudTrail events where a user A who has in case new victim(user B) has more permissions than old victim(user B) search: ' `cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com errorCode = success -| eval match=if(match(userIdentity.userName,requestParameters.userName),0,1) +| eval match=if(match(userIdentity.userName,requestParameters.userName), 1,0) | search match=0 | stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName