Sagan critical stable other

[AWS-GUARDDUTY] GuardDuty event detected (CredentialAccess:Kubernetes/SuccessfulAnonymousAccess)

[AWS-GUARDDUTY] GuardDuty event detected (CredentialAccess:Kubernetes/SuccessfulAnonymousAccess)

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[AWS-GUARDDUTY] GuardDuty event detected (CredentialAccess:Kubernetes/SuccessfulAnonymousAccess) "; program:guardduty; content:"CredentialAccess:Kubernetes/SuccessfulAnonymousAccess"; content:!"sample
| 5c 5c 5c 22 3a
| true"; normalize; classtype:trojan-activity; parse_src_ip: 1; reference:url,docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-active.html; sid:5010354; rev:2; metadata: mitre_technique_id T1003, mitre_technique_id T1078;)

Field Validations

Loading…

Comments (0)

Loading comments...