Sagan informational stable other

[AWS-SECRETSMANAGER] DeleteSecret Event Detected

[AWS-SECRETSMANAGER] DeleteSecret Event Detected

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[AWS-SECRETSMANAGER] DeleteSecret Event Detected"; program:secretsmanager.amazonaws.com; json_content:".eventName","DeleteSecret"; content: !"
| 22
| mfaAuthenticated
| 22 3a 20 22
| true
| 22
| "; parse_src_ip:1; classtype:system-event; reference:url,https://docs.aws.amazon.com/secretsmanager/latest/apireference/Welcome.html; sid:5014207; rev:2;)

Field Validations

Loading…

Comments (0)

Loading comments...