Elastic low stable kql

AWS SNS Rare Protocol Subscription by User

Identifies when a user subscribes to an SNS topic using a new protocol type (ie. email, http, lambda, etc.). SNS allows users to subscribe to recieve topic messages across a broad range of protocols like email, sms, lambda functions, http endpoints, and applications. Adversaries may subscribe to an SNS topic to collect sensitive information or exfiltrate data via an external email address, cross-account AWS service or other means. This rule identifies a new protocol subscription method for a particular user.

View Source

Detection Logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "sns.amazonaws.com"
    and event.action: "Subscribe"
    and event.outcome: "success"
    and not user_agent.original: (*Terraform*)

False Positives

⚠ Legitimate users may subscribe to SNS topics for legitimate purposes. Ensure that the subscription is authorized before taking action.

Field Validations

Loading…

Comments (0)

Loading comments...