Anvilogic low experimental other

AWS IAM Enumeration [snowflake-awscloudtrail]

Amazon Elastic Container Services or ECS, is an offering from Amazon Web Services (AWS) designed to provide a platform to host containerized applications in the cloud. Adversaries may enumerate Task definitions as they are responsible for configuring the actual containers that will be running in ECS. Since task definitions define how containers will run, a plethora of information can be found within. -- Threat Actor Association: GUI-vil

View Source

Detection Logic

select * from awscloudtrail where event_time > dateadd(hour, -2, sysdate()) and (event_name = 'ListAttachedRolePolicies' or event_name = 'ListRolePolicies')

Field Validations

Loading…

Comments (0)

Loading comments...