security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
7,892 Commits 1 Branch 57 Tags
fefb8564717d69af72ededb4172bc7ec00aac734
Commit Graph

36 Commits

Author SHA1 Message Date
frack113 0288f5b626 fix condition operator case 2021-09-10 13:51:52 +02:00
Rachel Rice be5351947c Unset date update 
Signed-off-by: Rachel Rice <rachel.rice@lacework.net>
 2021-09-07 16:36:59 +01:00
Rachel Rice eef6e71e2e Update AWS Update Login Profile Rule fields 
Missed updating field from `responseElements.accessKey.userName` to `requestParameters.userName` on last update.
 2021-09-07 12:39:56 +01:00
frack113 bd1b4c0d70 Merge pull request #1978 from rachelrice/update_aws_login 
Update AWS Update Login Profile rule
 2021-09-03 08:12:28 +02:00
Rachel Rice 78d3fa4795 Update AWS STS AssumeRole Misuse rule 
Update selection criteria for AWS STS AssumeRole Misuse rule for any event by an AssumedRole userIdentity.
Closes SigmaHQ/sigma#1963.
 2021-09-02 17:40:35 +01:00
Rachel Rice 7ccb773b20 Update AWS Update Login Profile rule 
Update selection criteria for AWS Update Login Profile rule to check for mismatch between userIdentity.arn and requestParameters.userName.
Closes SigmaHQ/sigma#1966.
 2021-09-02 17:37:41 +01:00
frack113 52595de85e Merge pull request #1889 from rachelrice/update_aws_rules 
Update AWS CloudTrail rules
 2021-08-23 11:14:31 +02:00
frack113 b9a355e3f4 cleanup falsepositives 2021-08-20 17:18:32 +02:00
Florian Roth b92346ba5f Merge pull request #1882 from austinsonger/win_susp_bitstransfer.yml 
win_susp_bitstransfer.yml
 2021-08-20 16:53:52 +02:00
Rachel Rice f037f5b0a9 Add filter3 back for vm export failure, without consolelogin 
Signed-off-by: Rachel Rice <rachel.rice@lacework.net>
 2021-08-20 15:42:49 +01:00
Rachel Rice f09b3ea4b1 Update AWS CloudTrail rules 
aws_ec2_disable_encryption.yml
Remove `status: success` from selection criteria, not required

aws_ec2_vm_export_failure.yml
Remove filter3:
```
eventName: 'ConsoleLogin'
responseElements|contains: 'Failure'
```
Incompatible with selection criteria `eventName: 'CreateInstanceExportTask'`

aws_ec2_download_userdata.yml, aws_iam_backdoor_users_keys.yml, aws_rds_change_master_password.yml, aws_rds_public_db_restore.yml
Update reference

aws_sts_assumedrole_misuse.yml
Rename to aws_sts_assumerole_misuse.yml
Update references to "AssumedRole" to "AssumeRole"
Update selection criteria of `userIdentity.sessionContext: Role` to `userIdentity.sessionContext.sessionIssuer.type: Role`
 2021-08-20 13:43:00 +01:00
Austin Songer 810aae5ddd Update aws_eks_cluster_created_or_deleted.yml 2021-08-19 21:58:36 -05:00
Austin Songer 842ade16be Forgot to add my username to some of the rules. 2021-08-20 02:09:31 +00:00
Austin Songer 9a83836070 Update aws_eks_cluster_created_or_deleted.yml 2021-08-19 21:00:36 -05:00
Rachel Rice 67020bb0ff Update AWS CloudTrail rules 
aws_elasticache_security_group_created.yml
aws_elasticache_security_group_modified_or_deleted.yml
Removed spaces from eventNames

aws_s3_data_management_tampering.yml
Fix typo in title, use s3 as eventSource

aws_snapshot_backup_exfiltration.yml
Use ec2 as eventSource
 2021-08-19 14:24:43 +01:00
frack113 63733a623e Merge pull request #1861 from austinsonger/aws_eks_cluster_modified_or_deleted.yml 
aws_eks_cluster_created_or_deleted.yml
 2021-08-17 06:25:18 +02:00
frack113 accb675ed5 fix error space 2021-08-16 20:36:55 +02:00
Austin Songer 80062ff5cd Update aws_eks_cluster_created_or_deleted.yml 2021-08-16 12:42:14 -05:00
Austin Songer cfb863a98e Update aws_eks_cluster_created_or_deleted.yml 2021-08-16 11:52:22 -05:00
Austin Songer ed507b82f4 Update and rename aws_eks_cluster_modified_or_deleted.yml to aws_eks_cluster_created_or_deleted.yml 2021-08-16 09:58:48 -05:00
frack113 0973c51ef5 Merge pull request #1850 from austinsonger/aws_efs_fileshare_modified_or_deleted.yml 
aws_efs_fileshare_modified_or_deleted.yml
 2021-08-16 07:36:43 +02:00
Austin Songer 2524adc6ca Update aws_efs_fileshare_mount_modified_or_deleted.yml 2021-08-15 22:54:11 -05:00
Austin Songer fb117d5714 Update aws_efs_fileshare_mount_modified_or_deleted.yml 2021-08-15 22:52:53 -05:00
Austin Songer 5a22d07392 Update aws_efs_fileshare_modified_or_deleted.yml 2021-08-15 22:52:41 -05:00
Austin Songer ebf2b7a313 Update aws_efs_fileshare_modified_or_deleted.yml 2021-08-15 22:49:01 -05:00
Austin Songer 28f6cbe2b8 Update aws_efs_fileshare_modified_or_deleted.yml 2021-08-15 15:37:07 -05:00
Austin Songer b5766f8804 Update aws_efs_fileshare_modified_or_deleted.yml 2021-08-15 15:36:34 -05:00
Austin Songer db7d2958d3 Update aws_efs_fileshare_mount_modified_or_deleted.yml 2021-08-15 15:04:24 -05:00
Austin Songer cfb6f4e4fb Create aws_eks_cluster_modified_or_deleted.yml 2021-08-15 14:33:44 -05:00
Austin Songer d6bbdf2750 Delete aws_eks_cluster_modified_or_deleted.yml 2021-08-15 14:33:35 -05:00
Austin Songer 532f912991 Create aws_eks_cluster_modified_or_deleted.yml 2021-08-15 14:33:28 -05:00
Austin Songer 5f2160c1b2 Delete aws_s3_control_modified_or_deleted.yml 2021-08-15 14:32:12 -05:00
Austin Songer b0f6f11309 Create aws_s3_control_modified_or_deleted.yml 2021-08-15 14:31:04 -05:00
Austin Songer bde91611a9 Create aws_efs_fileshare_modified_or_deleted.yml 2021-08-15 14:27:22 -05:00
Austin Songer a0df8ce84c Create aws_efs_fileshare_mount_modified_or_deleted.yml 2021-08-15 14:26:48 -05:00
frack113 c0aa9696dd move aws rules 2021-08-13 15:40:03 +02:00