Anvilogic low experimental other

ECS Enumeration AWS [snowflake-awscloudtrail]

Amazon Elastic Container Services or ECS, is an offering from Amazon Web Services (AWS) designed to provide a platform to host containerized applications in the cloud. Adversaries may enumerate the targeted environment for all avialable information on ECS.

View Source

Detection Logic

select * from awscloudtrail where event_time > dateadd(hour, -2, sysdate()) and event_type = 'AwsApiCall' and event_source = 'ecs.amazonaws.com' and ( event_name = 'ListClusters' or event_name = 'ListContainerInstances' or event_name = 'ListServices' or event_name = 'ListTaskDefinitions' )

Field Validations

Loading…

Comments (0)

Loading comments...