security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
8,994 Commits 1 Branch 57 Tags
01dc930c173e329c191245b76f05de5fa4b5da21
Commit Graph

61 Commits

Author SHA1 Message Date
frack113 b293372913 Add product aws 2021-11-14 09:56:59 +01:00
Stefan Grimminck 47502e6701 add MITRE technique mapping 2021-10-20 14:29:57 +02:00
Austin Songer 7ad0887704 Update passed_role_to_glue_development_endpoint.yml 2021-10-14 12:10:48 -05:00
Austin Songer 70b55f2c2d Update aws_lambda_function_created_or_invoked.yml 2021-10-14 12:10:29 -05:00
Austin Songer 40879252a8 Update aws_lambda_function_created_or_invoked.yml 2021-10-13 16:25:28 -05:00
Austin Songer f7dba3fbff Update passed_role_to_glue_development_endpoint.yml 2021-10-13 12:34:16 -05:00
Austin Songer 503a4bc72b Update and rename aws_pass_role_to_lambda_function.yml to aws_lambda_function_created_or_invoked.yml 2021-10-13 12:27:24 -05:00
Austin Songer e08f6333b8 Update aws_pass_role_to_lambda_function.yml 2021-10-13 06:59:13 -05:00
Austin Songer 010b0e2868 Update passed_role_to_glue_development_endpoint.yml 2021-10-13 06:58:57 -05:00
frack113 d081d20a13 Merge pull request #2119 from austinsonger/privilege_escalation_pass_role_to_lambda_function.yml 
passed_role_to_glue_development_endpoint.yml and passed_role_to_lambda_function.yml
 2021-10-10 11:01:36 +02:00
Austin Songer 1987897a76 Update aws_pass_role_to_lambda_function.yml 2021-10-09 15:26:38 -05:00
Austin Songer de52890a62 Update passed_role_to_glue_development_endpoint.yml 2021-10-09 15:24:49 -05:00
Rachel Rice d9e5da6c86 Use startswith for eventName selection 
Signed-off-by: Rachel Rice <rachel.rice@lacework.net>
 2021-10-05 17:52:52 +01:00
Rachel Rice 4ae3ece314 Update AWS SAML and Lambda rules 
Use correct case for `AssumeRoleWithSAML` event name.
`UpdateFunctionConfiguration`, `UpdateFunctionConfiguration20150331` and `UpdateFunctionConfiguration20150331v2` are all valid event names for updating Lambda function configuration, added selection condition for any of these.
 2021-10-05 14:08:40 +01:00
frack113 ad9362e043 Update passed_role_to_glue_development_endpoint.yml 2021-10-05 07:41:41 +02:00
frack113 3b01425936 Update aws_pass_role_to_lambda_function.yml 2021-10-05 07:40:42 +02:00
Austin Songer d694d6faa8 Create passed_role_to_glue_development_endpoint.yml 2021-10-03 23:03:39 -05:00
Austin Songer 60eccf711d Rename pass_role_to_lambda_function.yml to aws_pass_role_to_lambda_function.yml 2021-10-03 22:54:19 -05:00
Austin Songer 92b1ce4cf4 Create pass_role_to_lambda_function.yml 2021-10-03 22:54:01 -05:00
Austin Songer 0d07a78a2d Update aws_attached_malicious_lambda_layer.yml 2021-09-27 23:41:19 -05:00
Austin Songer 8203a2d5f2 Update aws_attached_malicious_lambda_layer.yml 2021-09-23 08:40:26 -05:00
Austin Songer fdc45505e0 Create aws_attached_malicious_lambda_layer.yml 2021-09-23 08:38:02 -05:00
Austin Songer b9123422b8 Delete aws_attached_malicious_lambda_layer.yml 2021-09-23 08:37:34 -05:00
Austin Songer 9e9fd4c23d Create aws_attached_malicious_lambda_layer.yml 2021-09-23 08:37:20 -05:00
frack113 934e391159 fix filename 2021-09-23 14:51:59 +02:00
frack113 0288f5b626 fix condition operator case 2021-09-10 13:51:52 +02:00
Rachel Rice be5351947c Unset date update 
Signed-off-by: Rachel Rice <rachel.rice@lacework.net>
 2021-09-07 16:36:59 +01:00
Rachel Rice eef6e71e2e Update AWS Update Login Profile Rule fields 
Missed updating field from `responseElements.accessKey.userName` to `requestParameters.userName` on last update.
 2021-09-07 12:39:56 +01:00
frack113 bd1b4c0d70 Merge pull request #1978 from rachelrice/update_aws_login 
Update AWS Update Login Profile rule
 2021-09-03 08:12:28 +02:00
Rachel Rice 78d3fa4795 Update AWS STS AssumeRole Misuse rule 
Update selection criteria for AWS STS AssumeRole Misuse rule for any event by an AssumedRole userIdentity.
Closes SigmaHQ/sigma#1963.
 2021-09-02 17:40:35 +01:00
Rachel Rice 7ccb773b20 Update AWS Update Login Profile rule 
Update selection criteria for AWS Update Login Profile rule to check for mismatch between userIdentity.arn and requestParameters.userName.
Closes SigmaHQ/sigma#1966.
 2021-09-02 17:37:41 +01:00
frack113 52595de85e Merge pull request #1889 from rachelrice/update_aws_rules 
Update AWS CloudTrail rules
 2021-08-23 11:14:31 +02:00
frack113 b9a355e3f4 cleanup falsepositives 2021-08-20 17:18:32 +02:00
Florian Roth b92346ba5f Merge pull request #1882 from austinsonger/win_susp_bitstransfer.yml 
win_susp_bitstransfer.yml
 2021-08-20 16:53:52 +02:00
Rachel Rice f037f5b0a9 Add filter3 back for vm export failure, without consolelogin 
Signed-off-by: Rachel Rice <rachel.rice@lacework.net>
 2021-08-20 15:42:49 +01:00
Rachel Rice f09b3ea4b1 Update AWS CloudTrail rules 
aws_ec2_disable_encryption.yml
Remove `status: success` from selection criteria, not required

aws_ec2_vm_export_failure.yml
Remove filter3:
```
eventName: 'ConsoleLogin'
responseElements|contains: 'Failure'
```
Incompatible with selection criteria `eventName: 'CreateInstanceExportTask'`

aws_ec2_download_userdata.yml, aws_iam_backdoor_users_keys.yml, aws_rds_change_master_password.yml, aws_rds_public_db_restore.yml
Update reference

aws_sts_assumedrole_misuse.yml
Rename to aws_sts_assumerole_misuse.yml
Update references to "AssumedRole" to "AssumeRole"
Update selection criteria of `userIdentity.sessionContext: Role` to `userIdentity.sessionContext.sessionIssuer.type: Role`
 2021-08-20 13:43:00 +01:00
Austin Songer 810aae5ddd Update aws_eks_cluster_created_or_deleted.yml 2021-08-19 21:58:36 -05:00
Austin Songer 842ade16be Forgot to add my username to some of the rules. 2021-08-20 02:09:31 +00:00
Austin Songer 9a83836070 Update aws_eks_cluster_created_or_deleted.yml 2021-08-19 21:00:36 -05:00
Rachel Rice 67020bb0ff Update AWS CloudTrail rules 
aws_elasticache_security_group_created.yml
aws_elasticache_security_group_modified_or_deleted.yml
Removed spaces from eventNames

aws_s3_data_management_tampering.yml
Fix typo in title, use s3 as eventSource

aws_snapshot_backup_exfiltration.yml
Use ec2 as eventSource
 2021-08-19 14:24:43 +01:00
frack113 63733a623e Merge pull request #1861 from austinsonger/aws_eks_cluster_modified_or_deleted.yml 
aws_eks_cluster_created_or_deleted.yml
 2021-08-17 06:25:18 +02:00
frack113 accb675ed5 fix error space 2021-08-16 20:36:55 +02:00
Austin Songer 80062ff5cd Update aws_eks_cluster_created_or_deleted.yml 2021-08-16 12:42:14 -05:00
Austin Songer cfb863a98e Update aws_eks_cluster_created_or_deleted.yml 2021-08-16 11:52:22 -05:00
Austin Songer ed507b82f4 Update and rename aws_eks_cluster_modified_or_deleted.yml to aws_eks_cluster_created_or_deleted.yml 2021-08-16 09:58:48 -05:00
frack113 0973c51ef5 Merge pull request #1850 from austinsonger/aws_efs_fileshare_modified_or_deleted.yml 
aws_efs_fileshare_modified_or_deleted.yml
 2021-08-16 07:36:43 +02:00
Austin Songer 2524adc6ca Update aws_efs_fileshare_mount_modified_or_deleted.yml 2021-08-15 22:54:11 -05:00
Austin Songer fb117d5714 Update aws_efs_fileshare_mount_modified_or_deleted.yml 2021-08-15 22:52:53 -05:00
Austin Songer 5a22d07392 Update aws_efs_fileshare_modified_or_deleted.yml 2021-08-15 22:52:41 -05:00
Austin Songer ebf2b7a313 Update aws_efs_fileshare_modified_or_deleted.yml 2021-08-15 22:49:01 -05:00