Anvilogic low experimental other

AWS Storage Enumeration [snowflake-awscloudtrail]

Identify commands associated with enumerating storage services like S3 in AWS -- Threat Actor Association: GUI-vil

View Source

Detection Logic

select * from awscloudtrail where event_time > dateadd(hour, -2, sysdate()) and (event_name = 'ListBuckets' or event_name = 'GetBucketCors' or event_name = 'GetBucketInventoryConfiguration' or event_name = 'GetBucketPublicAccessBlock' or event_name = 'GetBucketMetricsConfiguration' or event_name = 'GetBucketPolicy' or event_name = 'GetBucketTagging')

Field Validations

Loading…

Comments (0)

Loading comments...