Anvilogic high experimental other

AWS EnableAddressTransfer [snowflake-awscloudtrail]

Threat identifier for AWS API call EnableAddressTransfer can be used in Elastic IP Hijacking attack

View Source

Detection Logic

select * from awscloudtrail where event_time > dateadd(hour, -2, sysdate()) and event_name = 'EnableAddressTransfer'

Field Validations

Loading…

Comments (0)

Loading comments...