Elastic high stable kql

AWS SNS Topic Message Publish by Rare User

Identifies when an SNS topic message is published by a rare user in AWS. Adversaries may publish messages to SNS topics for phishing campaigns, data exfiltration, or lateral movement within the AWS environment. SNS topics are used to send notifications and messages to subscribed endpoints such as applications, mobile devices or email addresses, making them a valuable target for adversaries to distribute malicious content or exfiltrate sensitive data. This is a New Terms rule that only flags when this behavior is observed for the first time by a user or role.

View Source

Detection Logic

data_stream.dataset:"aws.cloudtrail"
    and event.provider:"sns.amazonaws.com"
    and event.action:"Publish"
    and event.outcome:"success"

False Positives

⚠ New users or roles may legitimately publish messages to SNS topics for authorized purposes. Ensure that the action is authorized before taking action.

Field Validations

Loading…

Comments (0)

Loading comments...