Anvilogic low experimental other
AWS Get Cost and Usage [snowflake-awscloudtrail]
Adversaries may request cost and usage metrics for an account in order to determine accounts that are active with high costs. They can use this information to target active resources in an attempt to evade detection as the expenses might not be immediately noticeable.
Detection Logic
select * from awscloudtrail where event_time > dateadd(hour, -2, sysdate()) and event_name = 'GetCostAndUsage'Field Validations
Loading…
Comments (0)
Loading comments...