Anvilogic high experimental spl

Azure Update MFA [splunk-azure]

Identify when a user has had their security info updated. - Threat Actor Association: APT29, LUCR-3, Scattered Spider (aka. 0ktapus, UNC3944)

View Source

Detection Logic

`get_cloud_data` `get_cloud_data_iam` "User registered security info"
| eval reason=resultReason
| table _time, host, user, account, region, src_ip, http_user_agent, access_key, user, user_id, identity_type, role, event_name, event_category, cloud_service, request_parameters, response, mfa_enabled, permissions, identity, action, resource_id, object_id. dest_*
| bin span=1s
| stats values(*) as * by _time, user

Field Validations

Loading…

Comments (0)

Loading comments...