Terrance DeJesus 0b98462cfe [New Hunt] Adding Hunting Queries for AWS SNS exfiltration and data collection (#4458) ...

* new hunting queries for SNS

* added KEEP to all queries; adjusted description in SNS rule

2025-02-20 10:53:36 -05:00

..

ec2_discovery_multi_region_describe_instance_calls.md

[New Hunt] Add AWS Hunting Queries to Shared Hunting Library (#3988)

2024-09-04 10:08:44 -04:00

ec2_high_instance_deployment_count_attempts.md

[New Hunt] Add AWS Hunting Queries to Shared Hunting Library (#3988)

2024-09-04 10:08:44 -04:00

ec2_modify_instance_attribute_user_data.md

[New Hunt] Add AWS Hunting Queries to Shared Hunting Library (#3988)

2024-09-04 10:08:44 -04:00

ec2_suspicious_get_user_password_request.md

[New Hunt] Add AWS Hunting Queries to Shared Hunting Library (#3988)

2024-09-04 10:08:44 -04:00

iam_assume_role_creation_with_attached_policy.md

[New Hunts] Adding Several Hunting PRs into this Main PR (#4342)

2025-01-07 14:29:17 +01:00

iam_customer_managed_policies_attached_to_existing_roles.md

[New Hunts] Adding Several Hunting PRs into this Main PR (#4342)

2025-01-07 14:29:17 +01:00

iam_unusual_access_key_usage_for_user.md

[New Hunt] Adding Hunting Query for AWS IAM Unusual AWS Access Key Usage for User (#4280)

2024-12-12 14:56:20 -05:00

iam_unusual_default_aviatrix_role_activity.md

[Hunt Tuning] Fixing Sort Logic in Aviatrix Hunting Query (#4432)

2025-02-03 21:43:02 -05:00

iam_user_activity_with_no_mfa_session.md

[New Hunt] Add AWS Hunting Queries to Shared Hunting Library (#3988)

2024-09-04 10:08:44 -04:00

iam_user_creation_with_administrator_policy_assigned.md

[New Hunt] Add AWS Hunting Queries to Shared Hunting Library (#3988)

2024-09-04 10:08:44 -04:00

lambda_add_permissions_for_write_actions_to_function.md

[New Hunts] Adding Several Hunting PRs into this Main PR (#4342)

2025-01-07 14:29:17 +01:00

multiple_service_logging_deleted_or_stopped.md

[New Hunt] Add AWS Hunting Queries to Shared Hunting Library (#3988)

2024-09-04 10:08:44 -04:00

s3_public_bucket_rapid_object_access_attempts.md

[Hunting] Re-factor Hunting Library Code (#4085)

2024-10-03 12:47:40 -04:00

secretsmanager_high_frequency_get_secret_value.md

[New Hunt] Add AWS Hunting Queries to Shared Hunting Library (#3988)

2024-09-04 10:08:44 -04:00

servicequotas_discovery_multi_region_get_service_quota_calls.md

[New Hunt] Add AWS Hunting Queries to Shared Hunting Library (#3988)

2024-09-04 10:08:44 -04:00

signin_single_factor_console_login_via_federated_session.md

[New Hunts] Adding Several Hunting PRs into this Main PR (#4342)

2025-01-07 14:29:17 +01:00

sns_direct_to_phone_messaging_spike.md

[New Hunt] Adding Hunting Queries for AWS SNS exfiltration and data collection (#4458)

2025-02-20 10:53:36 -05:00

sns_email_subscription_by_rare_user.md

[New Hunt] Adding Hunting Queries for AWS SNS exfiltration and data collection (#4458)

2025-02-20 10:53:36 -05:00

sns_topic_created_by_rare_user.md

[New Hunt] Adding Hunting Queries for AWS SNS exfiltration and data collection (#4458)

2025-02-20 10:53:36 -05:00

sns_topic_message_published_by_rare_user.md

[New Hunt] Adding Hunting Queries for AWS SNS exfiltration and data collection (#4458)

2025-02-20 10:53:36 -05:00

ssm_rare_sendcommand_code_execution.md

[New Hunt] Add AWS Hunting Queries to Shared Hunting Library (#3988)

2024-09-04 10:08:44 -04:00

ssm_sendcommand_api_used_by_ec2_instance.md

[New Hunts] Adding Several Hunting PRs into this Main PR (#4342)

2025-01-07 14:29:17 +01:00

ssm_start_remote_session_to_ec2_instance.md

[New Hunt] Add AWS Hunting Queries to Shared Hunting Library (#3988)

2024-09-04 10:08:44 -04:00

sts_suspicious_federated_temporary_credential_request.md

[New Hunts] Adding Several Hunting PRs into this Main PR (#4342)

2025-01-07 14:29:17 +01:00