Anvilogic low experimental other

AWS SES Enumeration [snowflake-awscloudtrail]

Threat identifier for AWS API calls, ListAttachedRolePolicies and ListRolePolicies to identify potential IAM enumeration.

View Source

Detection Logic

select * from awscloudtrail where event_time > dateadd(hour, -2, sysdate()) and (event_name = 'GetAccount' or event_name = 'ListIdentities')

Field Validations

Loading…

Comments (0)

Loading comments...