Anvilogic high experimental other

AWS DisassociateAddress [snowflake-awscloudtrail]

Threat identifier for AWS API call DisassociateAddress, threat actors can initiate a Elastic IP Hijacking attack by querying for all IP addresses and disassociate an existing Elastic IP assign it to a new host

View Source

Detection Logic

select * from awscloudtrail where event_time > dateadd(hour, -2, sysdate()) and event_name = 'DisassociateAddress'

Field Validations

Loading…

Comments (0)

Loading comments...