Isai 3bfbafe583 [Rule Tuning] AWS Access Token Used from Multiple Addresses (#5412) ...

* [Rule Tuning] AWS Access Token Used from Multiple Addresses

This rule is extremely loud in telemetry ~2612 alerts in last 24 hours. There have also been a couple community requests for changes.
- reduced the scope of the alerts to only surface the "high" fidelity_score cases for `"multiple_ip_network_city"` or `"multiple_ip_network_city_user_agent"` criteria. This reduced telemetry by ~90%
- excluded 2 more benign service providers `support` which reduced volume by another 6%.
- added the `data_stream.namespace` field as requested.
- kept the rest of the rule logic visible so that if customers would like to broaden the scope of this rule again, they can duplicate the rules and revert back to the broader condition `Esql.activity_type != "normal_activity"`. This has been included as a comment in the rule query.

I will keep an eye on this rule in telemetry to determine it's value moving forward.

* nit IG format changes

2025-12-05 11:48:22 -05:00

..

collection_cloudtrail_logging_created.toml

[Rule Tuning] AWS Cloudtrail Created/Updated/Suspended/Deleted (#5292)

2025-11-14 02:48:52 -05:00

collection_s3_unauthenticated_bucket_access_by_rare_source.toml

[Tuning] AWS S3 Unauthenticated Bucket Access by Rare Source (#5075)

2025-09-11 17:13:41 -04:00

credential_access_aws_getpassword_for_ec2_instance.toml

[Rule Tuning] AWS EC2 Unauthorized Admin Credential Fetch via Assumed Role (#4774)

2025-06-06 15:08:48 -04:00

credential_access_iam_compromisedkeyquarantine_policy_attached_to_user.toml

[Rule Tuning] AWS IAM CompromisedKeyQuarantine Policy Attached to User (#5281)

2025-11-17 16:25:38 -05:00

credential_access_iam_user_addition_to_group.toml

[Rule Tunings] AWS Group Creation, User Added to Group, Group Deletion (#5269)

2025-11-14 02:34:28 -05:00

credential_access_new_terms_secretsmanager_getsecretvalue.toml

[Rule Tuning] First Time Seen AWS Secret Value Accessed in Secrets Manager (#4992)

2025-08-25 12:00:47 -04:00

credential_access_rapid_secret_retrieval_attempts_from_secretsmanager.toml

[Rule Tuning] Rapid Secret Retrieval Attempts from AWS SecretsManager (#5291)

2025-11-24 10:37:07 -05:00

credential_access_retrieve_secure_string_parameters_via_ssm.toml

[Rule Tunings] Reduce Usage of Flattened Fields in AWS Rules (#4892)

2025-07-18 19:15:36 -04:00

credential_access_root_console_failure_brute_force.toml

[Rule Tuning][Deprecation] AWS Root Console Login Rules (#5201)

2025-10-15 14:16:02 -04:00

defense_evasion_cloudtrail_logging_deleted.toml

[Rule Tuning] AWS Cloudtrail Created/Updated/Suspended/Deleted (#5292)

2025-11-14 02:48:52 -05:00

defense_evasion_cloudtrail_logging_evasion.toml

[New Rule] AWS CloudTrail Log Evasion (#4788)

2025-06-17 13:58:26 -04:00

defense_evasion_cloudtrail_logging_suspended.toml

[Rule Tuning] AWS Cloudtrail Created/Updated/Suspended/Deleted (#5292)

2025-11-14 02:48:52 -05:00

defense_evasion_cloudwatch_alarm_deletion.toml

[Rule Tunings] AWS CloudWatch Deletion Rules (#5316)

2025-11-24 10:49:17 -05:00

defense_evasion_config_service_rule_deletion.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_configuration_recorder_stopped.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_ec2_flow_log_deletion.toml

[Rule Tunings] AWS EC2 Flow Log Deletion and Network ACL Activity (#4778)

2025-06-06 14:11:54 -04:00

defense_evasion_ec2_network_acl_deletion.toml

[Rule Tunings] AWS EC2 Flow Log Deletion and Network ACL Activity (#4778)

2025-06-06 14:11:54 -04:00

defense_evasion_elasticache_security_group_creation.toml

[Deprecation] AWS Elasticache Security Group Rules (#5334)

2025-11-20 10:56:13 -05:00

defense_evasion_elasticache_security_group_modified_or_deleted.toml

[Deprecation] AWS Elasticache Security Group Rules (#5334)

2025-11-20 10:56:13 -05:00

defense_evasion_guardduty_detector_deletion.toml

[Rule Tuning] AWS GuardDuty Detector Deletion (#5309)

2025-11-24 10:58:00 -05:00

defense_evasion_rds_instance_restored.toml

[Rule Tunings] AWS RDS Rules (#5366)

2025-12-02 17:35:36 -05:00

defense_evasion_route53_dns_query_resolver_config_deletion.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_s3_bucket_configuration_deletion.toml

[Rule Tuning] AWS S3 Bucket Configuration Deletion (#5265)

2025-11-14 01:49:14 -05:00

defense_evasion_s3_bucket_lifecycle_expiration_added.toml

[Rule Tuning] AWS S3 Bucket Expiration Lifecycle Configuration Added (#5251)

2025-11-10 11:25:06 -05:00

defense_evasion_s3_bucket_server_access_logging_disabled.toml

[Rule Tuning] AWS S3 Bucket Server Access Logging Disabled (#5254)

2025-11-10 11:36:55 -05:00

defense_evasion_sqs_purge_queue.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_sts_get_federation_token.toml

[Tuning] First Occurrence of STS GetFederationToken Request by User (#5007)

2025-08-29 13:08:59 -04:00

defense_evasion_vpc_security_group_ingress_rule_added_for_remote_connections.toml

[Rule Tunings] Reduce Usage of Flattened Fields in AWS Rules (#4892)

2025-07-18 19:15:36 -04:00

defense_evasion_waf_acl_deletion.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_waf_rule_or_rule_group_deletion.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

discovery_ec2_deprecated_ami_discovery.toml

[Rule Tunings] Reduce Usage of Flattened Fields in AWS Rules (#4892)

2025-07-18 19:15:36 -04:00

discovery_ec2_multi_region_describe_instances.toml

[Rule Tuning] ESQL Query Field Dynamic Field Standardization (#4912)

2025-08-05 19:35:41 -04:00

discovery_ec2_multiple_discovery_api_calls_via_cli.toml

[Rule Tuning] ESQL Query Field Dynamic Field Standardization (#4912)

2025-08-05 19:35:41 -04:00

discovery_ec2_userdata_request_for_ec2_instance.toml

[Rule Tunings] Reduce Usage of Flattened Fields in AWS Rules (#4892)

2025-07-18 19:15:36 -04:00

discovery_iam_principal_enumeration_via_update_assume_role_policy.toml

[Rule Tuning] AWS IAM Brute Force of Assume Role Policy (#5282)

2025-12-03 11:31:06 -05:00

discovery_new_terms_sts_getcalleridentity.toml

[Rule Tuning] AWS STS GetCallerIdentity API Called for the First Time (#4995)

2025-08-25 11:44:58 -04:00

discovery_servicequotas_multi_region_service_quota_requests.toml

[Rule Tuning] ESQL Query Field Dynamic Field Standardization (#4912)

2025-08-05 19:35:41 -04:00

execution_lambda_external_layer_added_to_function.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

execution_new_terms_cloudformation_createstack.toml

[Tuning] First Time AWS Cloudformation Stack Creation by User (#5036)

2025-08-29 12:36:21 -04:00

execution_ssm_command_document_created_by_rare_user.toml

[Rule Tunings] AWS SSM Command Document Created by Rare User (#4848)

2025-06-27 13:24:27 -04:00

execution_ssm_sendcommand_by_rare_user.toml

[Rule Tunings] Reduce Usage of Flattened Fields in AWS Rules (#4892)

2025-07-18 19:15:36 -04:00

exfiltration_dynamodb_scan_by_unusual_user.toml

[Rule Tunings] AWS DynamoDB new terms Rules (#5074)

2025-09-11 16:59:39 -04:00

exfiltration_dynamodb_table_exported_to_s3.toml

[Rule Tunings] AWS DynamoDB new terms Rules (#5074)

2025-09-11 16:59:39 -04:00

exfiltration_ec2_ami_shared_with_separate_account.toml

[Rule Tuning] AWS EC2 AMI Shared with Another Account (#4914)

2025-07-21 10:12:13 +05:30

exfiltration_ec2_ebs_snapshot_shared_with_another_account.toml

[Rule Tunings] AWS EC2 EBS Snapshot and Encryption Rules (#5229)

2025-11-10 12:08:31 -05:00

exfiltration_ec2_export_task.toml

[New Rule][Deprecation] AWS EC2 Export Task Rules (#5248)

2025-11-10 11:15:13 -05:00

exfiltration_ec2_full_network_packet_capture_detected.toml

[Rule Tuning] AWS EC2 Full Network Packet Capture Detected (#5244)

2025-11-10 10:49:17 -05:00

exfiltration_ec2_vm_export_failure.toml

[New Rule][Deprecation] AWS EC2 Export Task Rules (#5248)

2025-11-10 11:15:13 -05:00

exfiltration_rds_snapshot_export.toml

[Rule Tunings] AWS RDS Rules (#5366)

2025-12-02 17:35:36 -05:00

exfiltration_rds_snapshot_shared_with_another_account.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

exfiltration_s3_bucket_policy_added_for_external_account_access.toml

[Rule Tuning][New Rule] AWS S3 Bucket Policy Added to Share with External Account/ to Allow Public Access (#5268)

2025-11-07 16:25:05 -05:00

exfiltration_s3_bucket_policy_added_for_public_access.toml

[Rule Tuning][New Rule] AWS S3 Bucket Policy Added to Share with External Account/ to Allow Public Access (#5268)

2025-11-07 16:25:05 -05:00

exfiltration_s3_bucket_replicated_to_external_account.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

exfiltration_sns_rare_protocol_subscription_by_user.toml

[Rule Tunings] AWS SNS new Terms rules (#5082)

2025-09-11 17:25:04 -04:00

impact_aws_eventbridge_rule_disabled_or_deleted.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

impact_aws_s3_bucket_enumeration_or_brute_force.toml

[Rule Tuning] AWS S3 Bucket Enumeration or Brute Force (#5173)

2025-10-06 11:53:41 -04:00

impact_cloudtrail_logging_updated.toml

[Rule Tuning] AWS Cloudtrail Created/Updated/Suspended/Deleted (#5292)

2025-11-14 02:48:52 -05:00

impact_cloudwatch_log_group_deletion.toml

[Rule Tunings] AWS CloudWatch Deletion Rules (#5316)

2025-11-24 10:49:17 -05:00

impact_cloudwatch_log_stream_deletion.toml

[Rule Tunings] AWS CloudWatch Deletion Rules (#5316)

2025-11-24 10:49:17 -05:00

impact_ec2_disable_ebs_encryption.toml

[Rule Tunings] AWS EC2 EBS Snapshot and Encryption Rules (#5229)

2025-11-10 12:08:31 -05:00

impact_ec2_ebs_snapshot_access_removed.toml

[Rule Tunings] AWS EC2 EBS Snapshot and Encryption Rules (#5229)

2025-11-10 12:08:31 -05:00

impact_efs_filesystem_deleted.toml

[Rule Tuning] AWS EFS File System Deleted (#5369)

2025-12-02 18:45:02 -05:00

impact_iam_deactivate_mfa_device.toml

[Rule Tuning] AWS IAM Virtual MFA Device Rules (#5275)

2025-11-17 15:13:48 -05:00

impact_iam_group_deletion.toml

[Rule Tunings] AWS Group Creation, User Added to Group, Group Deletion (#5269)

2025-11-14 02:34:28 -05:00

impact_kms_cmk_disabled_or_scheduled_for_deletion.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

impact_rds_group_deletion.toml

[Rule Deprecations] AWS RDS Lifecycle Rules and Outdated APIs (#5350)

2025-11-24 10:14:48 -05:00

impact_rds_instance_cluster_deletion_protection_disabled.toml

[Rule Tunings] AWS RDS Rules (#5366)

2025-12-02 17:35:36 -05:00

impact_rds_instance_cluster_deletion.toml

[Rule Tunings] AWS RDS Rules (#5366)

2025-12-02 17:35:36 -05:00

impact_rds_instance_cluster_stoppage.toml

[Rule Deprecations] AWS RDS Lifecycle Rules and Outdated APIs (#5350)

2025-11-24 10:14:48 -05:00

impact_rds_snapshot_deleted.toml

[Rule Tunings] AWS RDS Rules (#5366)

2025-12-02 17:35:36 -05:00

impact_s3_bucket_object_uploaded_with_ransom_extension.toml

[Rule Tuning] Potential AWS S3 Bucket Ransomware Note Uploaded (#5149)

2025-10-06 10:33:51 -04:00

impact_s3_excessive_object_encryption_with_sse_c.toml

[Rule Tunings] Reduce Usage of Flattened Fields in AWS Rules (#4892)

2025-07-18 19:15:36 -04:00

impact_s3_object_encryption_with_external_key.toml

[Rule Tuning] ESQL Query Field Dynamic Field Standardization (#4912)

2025-08-05 19:35:41 -04:00

impact_s3_object_versioning_disabled.toml

[Rule Tuning] AWS S3 Object Versioning Suspended (#5261)

2025-11-07 17:09:24 -05:00

impact_s3_static_site_js_file_uploaded.toml

[Rule Tuning] AWS S3 Static Site Javascript File Uploaded (#5264)

2025-11-07 17:00:56 -05:00

impact_s3_unusual_object_encryption_with_sse_c.toml

[Rule Tunings] Reduce Usage of Flattened Fields in AWS Rules (#4892)

2025-07-18 19:15:36 -04:00

initial_access_console_login_root.toml

[Rule Tuning][Deprecation] AWS Root Console Login Rules (#5201)

2025-10-15 14:16:02 -04:00

initial_access_iam_session_token_used_from_multiple_addresses.toml

[Rule Tuning] AWS Access Token Used from Multiple Addresses (#5412)

2025-12-05 11:48:22 -05:00

initial_access_kali_user_agent_detected_with_aws_cli.toml

[New Rule] Adding Coverage for AWS CLI with Kali Linux Fingerprint Identified (#4625)

2025-04-21 12:06:57 -04:00

initial_access_password_recovery.toml

[Rule Tunings] AWS Root Access Rules (#5218)

2025-10-15 13:58:32 -04:00

initial_access_signin_console_login_federated_user.toml

[Rule Tuning][New BBR Rule] AWS Sign-In Token Creation and Console Login (#5197)

2025-10-16 12:47:30 -04:00

lateral_movement_aws_ssm_start_session_to_ec2_instance.toml

[Rule Tuning] SSM Session Started to EC2 Instance (#5068)

2025-09-11 15:54:31 -04:00

lateral_movement_ec2_instance_connect_ssh_public_key_uploaded.toml

[Rule Tuning] AWS EC2 Instance Connect SSH Public Key Uploaded (#5069)

2025-09-11 16:37:39 -04:00

lateral_movement_ec2_instance_console_login.toml

[Rule Tuning] AWS EC2 Instance Console Login via Assumed Role (#5285)

2025-11-17 15:57:05 -05:00

lateral_movement_sns_topic_message_publish_by_rare_user.toml

[Rule Tunings] AWS SNS new Terms rules (#5082)

2025-09-11 17:25:04 -04:00

ml_cloudtrail_error_message_spike.toml

add mitre attack rules for ML job rules, bump dates (#5333)

2025-12-01 15:48:59 -06:00

ml_cloudtrail_rare_error_code.toml

add mitre attack rules for ML job rules, bump dates (#5333)

2025-12-01 15:48:59 -06:00

ml_cloudtrail_rare_method_by_city.toml

add mitre attack rules for ML job rules, bump dates (#5333)

2025-12-01 15:48:59 -06:00

ml_cloudtrail_rare_method_by_country.toml

add mitre attack rules for ML job rules, bump dates (#5333)

2025-12-01 15:48:59 -06:00

ml_cloudtrail_rare_method_by_user.toml

add mitre attack rules for ML job rules, bump dates (#5333)

2025-12-01 15:48:59 -06:00

NOTICE.txt

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

persistence_aws_attempt_to_register_virtual_mfa_device.toml

[Rule Tuning] AWS IAM Virtual MFA Device Rules (#5275)

2025-11-17 15:13:48 -05:00

persistence_ec2_network_acl_creation.toml

[Rule Tunings] AWS EC2 Flow Log Deletion and Network ACL Activity (#4778)

2025-06-06 14:11:54 -04:00

persistence_ec2_route_table_modified_or_deleted.toml

[Rule Tunings] AWS Route Table Created / AWS EC2 Route Table Modified or Deleted (#5064)

2025-09-11 15:35:16 -04:00

persistence_ec2_security_group_configuration_change_detection.toml

[Rule Tunings] Reduce Usage of Flattened Fields in AWS Rules (#4892)

2025-07-18 19:15:36 -04:00

persistence_iam_api_calls_via_user_session_token.toml

[Rule Tuning] AWS IAM API Calls via Temporary Session Tokens (#5310)

2025-11-24 10:27:22 -05:00

persistence_iam_create_login_profile_for_root.toml

[Rule Tunings] AWS Root Access Rules (#5218)

2025-10-15 13:58:32 -04:00

persistence_iam_create_user_via_assumed_role_on_ec2_instance.toml

[Tuning] AWS IAM Create User via Assumed Role on EC2 Instance (#5063)

2025-09-11 15:11:40 -04:00

persistence_iam_group_creation.toml

[Rule Tunings] AWS Group Creation, User Added to Group, Group Deletion (#5269)

2025-11-14 02:34:28 -05:00

persistence_iam_roles_anywhere_profile_created.toml

[Rule Tunings] AWS IAM Roles Anywhere Rules (#5307)

2025-11-24 11:09:53 -05:00

persistence_iam_roles_anywhere_trusted_anchor_created_with_external_ca.toml

[Rule Tunings] AWS IAM Roles Anywhere Rules (#5307)

2025-11-24 11:09:53 -05:00

persistence_iam_user_created_access_keys_for_another_user.toml

[Rule Tuning] AWS User Created Access Keys For Another User (#5212)

2025-10-16 12:57:57 -04:00

persistence_lambda_backdoor_invoke_function_for_any_principal.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_rds_cluster_creation.toml

[Rule Deprecations] AWS RDS Lifecycle Rules and Outdated APIs (#5350)

2025-11-24 10:14:48 -05:00

persistence_rds_db_instance_password_modified.toml

[Rule Tunings] AWS RDS Rules (#5366)

2025-12-02 17:35:36 -05:00

persistence_rds_group_creation.toml

[Rule Deprecations] AWS RDS Lifecycle Rules and Outdated APIs (#5350)

2025-11-24 10:14:48 -05:00

persistence_rds_instance_creation.toml

[Rule Deprecations] AWS RDS Lifecycle Rules and Outdated APIs (#5350)

2025-11-24 10:14:48 -05:00

persistence_rds_instance_made_public.toml

[Rule Tunings] AWS RDS Rules (#5366)

2025-12-02 17:35:36 -05:00

persistence_redshift_instance_creation.toml

[Deprecation] AWS Redshift Cluster Creation (#5367)

2025-12-03 13:02:19 -05:00

persistence_route_53_domain_transfer_lock_disabled.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_route_53_domain_transferred_to_another_account.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_route_53_hosted_zone_associated_with_a_vpc.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_route_table_created.toml

[Rule Tunings] AWS Route Table Created / AWS EC2 Route Table Modified or Deleted (#5064)

2025-09-11 15:35:16 -04:00

persistence_sts_assume_role_with_new_mfa.toml

[Rule Tuning] AWS STS AssumeRole with New MFA Device (#4999)

2025-08-22 14:48:39 -04:00

privilege_escalation_iam_administratoraccess_policy_attached_to_group.toml

[Rule Tunings] AWS IAM Administrator Access Policy Attached to Group/Role/User (#5215)

2025-10-16 12:22:56 -04:00

privilege_escalation_iam_administratoraccess_policy_attached_to_role.toml

[Rule Tunings] AWS IAM Administrator Access Policy Attached to Group/Role/User (#5215)

2025-10-16 12:22:56 -04:00

privilege_escalation_iam_administratoraccess_policy_attached_to_user.toml

[Rule Tunings] AWS IAM Administrator Access Policy Attached to Group/Role/User (#5215)

2025-10-16 12:22:56 -04:00

privilege_escalation_iam_customer_managed_policy_attached_to_role.toml

Prep 9.2 (#5231)

2025-10-17 21:01:13 +05:30

privilege_escalation_iam_saml_provider_updated.toml

[Rule Tuning] AWS IAM SAML Provider Updated (#5284)

2025-11-17 15:34:08 -05:00

privilege_escalation_iam_update_assume_role_policy.toml

Prep 9.2 (#5231)

2025-10-17 21:01:13 +05:30

privilege_escalation_role_assumption_by_service.toml

[Rule Tunings] AWS Role Assumption By Service / User (#4827)

2025-06-24 18:07:18 -04:00

privilege_escalation_role_assumption_by_user.toml

[Rule Tunings] AWS Role Assumption By Service / User (#4827)

2025-06-24 18:07:18 -04:00

privilege_escalation_sts_assume_root_from_rare_user_and_member_account.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

privilege_escalation_sts_role_chaining.toml

Update privilege_escalation_sts_role_chaining.toml (#5180)

2025-10-06 11:29:41 -04:00

resource_development_sns_topic_created_by_rare_user.toml

[Rule Tunings] AWS SNS new Terms rules (#5082)

2025-09-11 17:25:04 -04:00