Anvilogic low experimental spl
AWS Get Caller Identity [splunk-awscloudtrail]
Amazon Elastic Container Services or ECS, is an offering from Amazon Web Services (AWS) designed to provide a platform to host containerized applications in the cloud. Adversaries may enumerate Task definitions as they are responsible for configuring the actual containers that will be running in ECS. Since task definitions define how containers will run, a plethora of information can be found within.
Detection Logic
`get_cloud_data` `get_cloud_data_aws` TERM(GetCallerIdentity)
| table _time, host, user, account, region, src_ip, http_user_agent, access_key, user, user_id, identity_type, role, event_name, event_category, cloud_service, request_parameters, response, mfa_enabled, permissions, identity, action, resource_id, object_id
| bin span=1s
| stats values(*) as * by _time, src_ip
| lookup dnslookup clientip as src_ip OUTPUT clienthost as src_dns
| iplocation prefix="src_" src_ip
| rename src_Country as src_countryField Validations
Loading…
Comments (0)
Loading comments...