security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Closes #2216 (#2855)

Browse Source 
* Update privilege_escalation_sts_assumerole_usage.toml

* Update privilege_escalation_sts_assumerole_usage.toml

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
This commit is contained in:
Anthony
2024-06-14 04:52:54 +08:00
committed by GitHub
parent 020ca4be24
commit c1dcd21531
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/integrations/aws/privilege_escalation_sts_assumerole_usage.toml
+3 -1
View File
@@ -2,6 +2,8 @@
creation_date = "2021/05/17"
integration = ["aws"]
maturity = "production"
min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0"
min_stack_version = "8.9.0"
updated_date = "2024/05/21"
[rule]
@@ -34,7 +36,7 @@ timestamp_override = "event.ingested"
type = "query"
query = '''
event.dataset:aws.cloudtrail and event.provider:sts.amazonaws.com and event.action:AssumedRole and
event.dataset:aws.cloudtrail and event.provider:sts.amazonaws.com and event.action:AssumeRole and
aws.cloudtrail.user_identity.session_context.session_issuer.type:Role and event.outcome:success
'''