 Terrance DeJesus
|
cea2f43732
|
[New Rule] AWS EC2 LOLBin Execution via SSM (#5354)
* [New Rule] AWS EC2 LOLBin Execution via SSM
Fixes #5353
* updated from command
* removed high order tag
* adjusted query logic
* updated reference
* add ESQL_priv. to keep
* Update rules/cross-platform/execution_aws_ec2_lolbin_via_ssm.toml
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
* Update rules/cross-platform/execution_aws_ec2_lolbin_via_ssm.toml
* cleaned up comments
* updating query logic to use coalesce
* Update rules/cross-platform/execution_aws_ec2_lolbin_via_ssm.toml
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
* Update rules/cross-platform/execution_aws_ec2_lolbin_via_ssm.toml
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
* Update rules/cross-platform/execution_aws_ec2_lolbin_via_ssm.toml
* Update rules/cross-platform/execution_aws_ec2_lolbin_via_ssm.toml
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
* added SSM tag
---------
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
|
2025-12-05 16:14:33 -05:00 |
|