Update aws_pass_role_to_lambda_function.yml

2021-10-13 06:59:13 -05:00
parent 010b0e2868
commit e08f6333b8
1 changed files with 2 additions and 5 deletions
@@ -10,15 +10,12 @@ logsource:
    service: cloudtrail
 detection:
    selection1:
-        eventSource: iam.amazonaws.com
-        eventName: PassRole
-    selection2:
        eventSource: lambda.amazonaws.com
        eventName: CreateFunction
-    selection3:
+    selection2:
        eventSource: lambda.amazonaws.com
        eventName: InvokeFunction
-    condition: selection1 and selection2 and selection3
+    condition: selection1 and selection2
 level: low
 tags:
    - attack.privilege_escalation