Anvilogic high experimental spl

EC2 secrets and parameters dumping [splunk-ec2]

Enumerate secrets in AWS Secrets Manager and AWS Systems manager parameter store. Secrets Manager helps you improve the security posture of your organization. Secrets include database credentials, passwords, and third-party API keys. You can use Secrets Manager to store secrets centrally, encrypt secrets automatically, control access to secrets, and rotate secrets safely and automatically

View Source

Detection Logic

`get_cloud_data` `get_cloud_data_iam` "userIdentity.type"=IAMUser 
AND eventName="ListSecrets" 
AND eventSource="secretsmanager.amazonaws.com" 
AND eventType="AwsApiCall"
| table _time, host, user, account, region, src_ip, http_user_agent, access_key, user, user_id, identity_type, role, event_name, event_category, cloud_service, request_parameters, response, mfa_enabled, permissions, identity, action, resource_id, object_id, src
| bin span=60s
| stats values(*) as * by _time, src_ip
| lookup dnslookup clientip as src_ip OUTPUT clienthost as src_dns
| iplocation prefix="src_" src_ip
| rename src_Country as src_country

Field Validations

Loading…

Comments (0)

Loading comments...