Sagan informational stable other

[AWS-STS] Security Token Service event detected (GetAccessKeyInfo)

[AWS-STS] Security Token Service event detected (GetAccessKeyInfo)

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[AWS-STS] Security Token Service event detected (GetAccessKeyInfo) "; program:sts.amazonaws.com; content:"eventName
| 22 3a 20 22
| GetAccessKeyInfo"; content: ! "AWSReservedSSO_AWSAdministratorAccess"; content: ! "AWSServiceRole"; classtype:system-event; reference:url,docs.aws.amazon.com/STS/latest/APIReference/welcome.html; sid:5011433; rev:2;)

Field Validations

Loading…

Comments (0)

Loading comments...