Detection Logic
alert any $HOME_NET any -> $HOME_NET any (msg:"[AWS] AWS ConsoleLogin"; program:signin.amazonaws.com; json_content:".eventName","ConsoleLogin"; json_content:".responseElements.ConsoleLogin","Success"; parse_src_ip:1; normalize; classtype:system-event; sid:991001; rev:1; metadata: createdOn 2025_05_09, updatedOn 2025_07_30;)Field Validations
Loading…
Comments (0)
Loading comments...