Anvilogic medium experimental other

ECS Create Cluster [snowflake-awscloudtrail]

Amazon Elastic Container Service (Amazon ECS) a fully managed container orchestration service that simplifies cloud deployment, management, and scaling of containerized applications. AWS API action "CreateCluster" creates a new Amazon ECS cluster. This API event can be indicative of malicious activity if adversaries are abusing AWS resources to create new unauthorized resources or if it is performed with unusual or unauthorized access patterns, such as an unexpected source IP address or unusual frequency of requests.

View Source

Detection Logic

select * from awscloudtrail where event_time > dateadd(hour, -2, sysdate()) and event_type = 'AwsApiCall' and event_source = 'ecs.amazonaws.com' and event_name = 'CreateCluster'

Field Validations

Loading…

Comments (0)

Loading comments...