Terrance DeJesus 0b98462cfe [New Hunt] Adding Hunting Queries for AWS SNS exfiltration and data collection (#4458) ...

* new hunting queries for SNS

* added KEEP to all queries; adjusted description in SNS rule

2025-02-20 10:53:36 -05:00

..

ec2_discovery_multi_region_describe_instance_calls.toml

[New Hunt] Add AWS Hunting Queries to Shared Hunting Library (#3988)

2024-09-04 10:08:44 -04:00

ec2_high_instance_deployment_count_attempts.toml

[New Hunt] Add AWS Hunting Queries to Shared Hunting Library (#3988)

2024-09-04 10:08:44 -04:00

ec2_modify_instance_attribute_user_data.toml

[New Hunt] Add AWS Hunting Queries to Shared Hunting Library (#3988)

2024-09-04 10:08:44 -04:00

ec2_suspicious_get_user_password_request.toml

[New Hunt] Add AWS Hunting Queries to Shared Hunting Library (#3988)

2024-09-04 10:08:44 -04:00

iam_assume_role_creation_with_attached_policy.toml

[Hunt Tuning] Enforce STATS or KEEP functions in ES|QL hunting queries (#4157)

2024-10-16 09:16:28 -04:00

iam_customer_managed_policies_attached_to_existing_roles.toml

[New Rule] Adding Coverage for AWS IAM Customer-Managed Policy Attached to Role by Rare User (#4245)

2024-11-06 13:36:13 -05:00

iam_unusual_access_key_usage_for_user.toml

[New Hunt] Adding Hunting Query for AWS IAM Unusual AWS Access Key Usage for User (#4280)

2024-12-12 14:56:20 -05:00

iam_unusual_default_aviatrix_role_activity.toml

[Hunt Tuning] Fixing Sort Logic in Aviatrix Hunting Query (#4432)

2025-02-03 21:43:02 -05:00

iam_user_activity_with_no_mfa_session.toml

[New Hunt] Add AWS Hunting Queries to Shared Hunting Library (#3988)

2024-09-04 10:08:44 -04:00

iam_user_creation_with_administrator_policy_assigned.toml

[New Hunt] Add AWS Hunting Queries to Shared Hunting Library (#3988)

2024-09-04 10:08:44 -04:00

lambda_add_permissions_for_write_actions_to_function.toml

[Hunt Tuning] Enforce STATS or KEEP functions in ES|QL hunting queries (#4157)

2024-10-16 09:16:28 -04:00

multiple_service_logging_deleted_or_stopped.toml

[New Hunt] Add AWS Hunting Queries to Shared Hunting Library (#3988)

2024-09-04 10:08:44 -04:00

s3_public_bucket_rapid_object_access_attempts.toml

[Hunting] Re-factor Hunting Library Code (#4085)

2024-10-03 12:47:40 -04:00

secretsmanager_high_frequency_get_secret_value.toml

[New Hunt] Add AWS Hunting Queries to Shared Hunting Library (#3988)

2024-09-04 10:08:44 -04:00

servicequotas_discovery_multi_region_get_service_quota_calls.toml

[New Hunt] Add AWS Hunting Queries to Shared Hunting Library (#3988)

2024-09-04 10:08:44 -04:00

signin_single_factor_console_login_via_federated_session.toml

[Hunt Tuning] Enforce STATS or KEEP functions in ES|QL hunting queries (#4157)

2024-10-16 09:16:28 -04:00

sns_direct_to_phone_messaging_spike.toml

[New Hunt] Adding Hunting Queries for AWS SNS exfiltration and data collection (#4458)

2025-02-20 10:53:36 -05:00

sns_email_subscription_by_rare_user.toml

[New Hunt] Adding Hunting Queries for AWS SNS exfiltration and data collection (#4458)

2025-02-20 10:53:36 -05:00

sns_topic_created_by_rare_user.toml

[New Hunt] Adding Hunting Queries for AWS SNS exfiltration and data collection (#4458)

2025-02-20 10:53:36 -05:00

sns_topic_message_published_by_rare_user.toml

[New Hunt] Adding Hunting Queries for AWS SNS exfiltration and data collection (#4458)

2025-02-20 10:53:36 -05:00

ssm_rare_sendcommand_code_execution.toml

[New Hunt] Add AWS Hunting Queries to Shared Hunting Library (#3988)

2024-09-04 10:08:44 -04:00

ssm_sendcommand_api_used_by_ec2_instance.toml

[Hunt Tuning] Enforce STATS or KEEP functions in ES|QL hunting queries (#4157)

2024-10-16 09:16:28 -04:00

ssm_start_remote_session_to_ec2_instance.toml

[New Hunt] Add AWS Hunting Queries to Shared Hunting Library (#3988)

2024-09-04 10:08:44 -04:00

sts_suspicious_federated_temporary_credential_request.toml

[Hunt Tuning] Enforce STATS or KEEP functions in ES|QL hunting queries (#4157)

2024-10-16 09:16:28 -04:00