Anvilogic low experimental other

AWS Logging Enumeration [snowflake-awscloudtrail]

Threat identifier for AWS API calls associated with logging enumeration.

View Source

Detection Logic

select * from awscloudtrail where event_time > dateadd(hour, -2, sysdate()) and event_name IN('GetQueryResults', 'GetBucketLogging', 'GetLogRecord', 'GetFlowLogsIntegrationTemplate', 'DescribeLogGroups', 'DescribeLogStreams', 'DescribeFlowLogs', 'DescribeSubscriptionFilters', 'ListTagsLogGroup')

Field Validations

Loading…

Comments (0)

Loading comments...