sigma-rules

Files

T

Terrance DeJesus f02ccfef64 [New Rule] Adding Coverage for AWS IAM or STS API Calls via Temporary Session Tokens (#4628 )

* adding new rule 'AWS IAM or STS API Calls via Temporary Session Tokens'

* updated name and query logic

* updated query logic

* changed rule to new terms

* fixed logic

* Update rules/integrations/aws/persistence_iam_sts_api_calls_via_user_session_token.toml

* Update rules/integrations/aws/persistence_iam_sts_api_calls_via_user_session_token.toml

* updated investigation guide; scoped to IAM only; updated naming

* updating file name

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

2025-04-24 15:39:51 -04:00

aws

[New Rule] Adding Coverage for AWS IAM or STS API Calls via Temporary Session Tokens (#4628 )

2025-04-24 15:39:51 -04:00

aws_bedrock

Prep for Release 9.0 (#4550 )

2025-03-20 20:32:07 +05:30

azure

[New] Suspicious Azure Sign-in via Visual Studio Code (#4639 )

2025-04-23 14:06:05 +01:00

azure_openai

Add investigation guides (#4600 )