Elastic low stable kql

AWS SNS Topic Created by Rare User

Identifies when an SNS topic is created by a user who does not typically perform this action. Adversaries may create SNS topics to stage capabilities for data exfiltration or other malicious activities. This is a New Terms rule that only flags when this behavior is observed for the first time by a user or role.

View Source

Detection Logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "sns.amazonaws.com"
    and event.action: "CreateTopic"
    and event.outcome: "success"

False Positives

⚠ Legitimate users may create SNS topics for legitimate purposes. Ensure that the creation is authorized before taking action.

Field Validations

Loading…

Comments (0)

Loading comments...