Anvilogic low experimental spl

AWS Get Cost and Usage [splunk-awscloudtrail]

Adversaries may request cost and usage metrics for an account in order to determine accounts that are active with high costs. They can use this information to target active resources in an attempt to evade detection as the expenses might not be immediately noticeable.

View Source

Detection Logic

`get_cloud_data` `get_cloud_data_aws` TERM(GetCostAndUsage)
| table _time, host, user, account, region, src_ip, http_user_agent, access_key, user, user_id, identity_type, role, event_name, event_category, cloud_service, request_parameters, response, mfa_enabled, permissions, identity, action, resource_id, object_id
| bin span=1s
| stats values(*) as * by _time, src_ip
| lookup dnslookup clientip as src_ip OUTPUT clienthost as src_dns
| iplocation prefix="src_" src_ip
| rename src_Country as src_country

Field Validations

Loading…

Comments (0)

Loading comments...