Anvilogic low experimental other

AWS Account Discovery [snowflake-awscloudtrail]

Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. -- Threat Actor Association: GUI-vil

View Source

Detection Logic

select * from awscloudtrail where event_time > dateadd(hour, -2, sysdate()) and ( event_name = 'ListAccounts' or event_name = 'ListAccountAliases' or event_name = 'ListAccountSettings' )

Field Validations

Loading…

Comments (0)

Loading comments...