Sagan informational stable other

[AWS-IAM] Identity and Access Management event detected (AddUserToGroup)

[AWS-IAM] Identity and Access Management event detected (AddUserToGroup)

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[AWS-IAM] Identity and Access Management event detected (AddUserToGroup) "; program:iam.amazonaws.com; json_content:".eventName","AddUserToGroup"; parse_src_ip: 1; content: !"
| 22
| mfaAuthenticated
| 22 3a 20 22
| true
| 22
| "; content: ! "AWSReservedSSO_AWSAdministratorAccess"; content: ! "AWSServiceRole"; classtype:system-event; reference:url,docs.aws.amazon.com/IAM/latest/APIReference/API_Operations.html; sid:5008154; rev:2;)

Field Validations

Loading…

Comments (0)

Loading comments...