Sagan unknown stable other

[AWS-SES] Simple Email Service Discovery Event Detected (GetAccount)

[AWS-SES] Simple Email Service Discovery Event Detected (GetAccount)

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[AWS-SES] Simple Email Service Discovery Event Detected (GetAccount)"; program:ses.amazonaws.com; content:"eventName
| 22 3a 20 22
| GetAccount"; parse_src_ip: 1; content: !"
| 22
| mfaAuthenticated
| 22 3a 20 22
| true
| 22
| "; classtype:discovery; reference:url,https://unit42.paloaltonetworks.com/large-scale-cloud-extortion-operation/; sid:5015090; rev:1; metadata:mitre_tactic_id TA0007;)

Field Validations

Loading…

Comments (0)

Loading comments...