mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
bpatel
28 lines
1.5 KiB
YAML
28 lines
1.5 KiB
YAML
name: Cloud Cryptomining
|
|
detections:
|
|
- name: Cloud Compute Instance Created In Previously Unused Region
|
|
file: cloud/cloud_compute_instance_created_in_previously_unused_region.yml
|
|
pass_condition: '| stats count | where count > 0'
|
|
- name: Cloud Compute Instance Created With Previously Unseen Image
|
|
file: cloud/cloud_compute_instance_created_with_previously_unseen_image.yml
|
|
pass_condition: '| stats count | where count > 0'
|
|
- name: Cloud Compute Instance Created With Previously Unseen Instance Type
|
|
file: cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml
|
|
pass_condition: '| stats count | where count > 0'
|
|
- name: Cloud Compute Instance Created By Previously Unseen User
|
|
file: cloud/cloud_compute_instance_created_by_previously_unseen_user.yml
|
|
pass_condition: '| stats count | where count > 0'
|
|
- name: Abnormally High Number of Cloud Instances Launched
|
|
file: cloud/abnormally_high_cloud_instances_launched.yml
|
|
pass_condition: '| stats count | where count > 0'
|
|
- name: Abnormally High Number Of Cloud Instances Destroyed
|
|
file: cloud/abnormally_high_cloud_instances_destroyed.yml
|
|
pass_condition: '| stats count | where count > 0'
|
|
description: Test Cloud Cryptomining detections
|
|
target: N/A
|
|
simulation_technique: N/A
|
|
attack_data:
|
|
- file_name: cloudtrail_behavioural_detections.json
|
|
data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
|
|
sourcetype: aws:cloudtrail
|