Isai 0b64638bf7 [New Rule] AWS Credentials Searched For Inside a Container (#2887) ...

* new rule toml

* Updated query

updated query based on review and added additional search queries

* updated rule query based on review

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>

2023-07-17 12:29:02 -04:00

..

container_workload_protection.toml

[Security Content] Tags Reform (#2725)

2023-06-22 18:38:56 -03:00

credential_access_aws_creds_search_inside_a_container.toml

[New Rule] AWS Credentials Searched For Inside a Container (#2887)

2023-07-17 12:29:02 -04:00

credential_access_collection_sensitive_files_compression_inside_a_container.toml

[Security Content] Tags Reform (#2725)

2023-06-22 18:38:56 -03:00

credential_access_sensitive_keys_or_passwords_search_inside_a_container.toml

[Security Content] Tags Reform (#2725)

2023-06-22 18:38:56 -03:00

discovery_suspicious_network_tool_launched_inside_a_container.toml

[Security Content] Tags Reform (#2725)

2023-06-22 18:38:56 -03:00

execution_container_management_binary_launched_inside_a_container.toml

[Security Content] Tags Reform (#2725)

2023-06-22 18:38:56 -03:00

execution_file_made_executable_via_chmod_inside_a_container.toml

[Security Content] Tags Reform (#2725)

2023-06-22 18:38:56 -03:00

execution_interactive_exec_to_container.toml

[Security Content] Tags Reform (#2725)

2023-06-22 18:38:56 -03:00

execution_interactive_shell_spawned_from_inside_a_container.toml

[Security Content] Tags Reform (#2725)

2023-06-22 18:38:56 -03:00

execution_netcat_listener_established_inside_a_container.toml

[Security Content] Tags Reform (#2725)

2023-06-22 18:38:56 -03:00

initial_access_ssh_connection_established_inside_a_container.toml

[Security Content] Tags Reform (#2725)

2023-06-22 18:38:56 -03:00

lateral_movement_ssh_process_launched_inside_a_container.toml

[Security Content] Tags Reform (#2725)

2023-06-22 18:38:56 -03:00

persistence_ssh_authorized_keys_modification_inside_a_container.toml

[Security Content] Tags Reform (#2725)

2023-06-22 18:38:56 -03:00