valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-06 09:25:17 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update AWS SAML and Lambda rules

Browse Source 
Use correct case for `AssumeRoleWithSAML` event name.
`UpdateFunctionConfiguration`, `UpdateFunctionConfiguration20150331` and `UpdateFunctionConfiguration20150331v2` are all valid event names for updating Lambda function configuration, added selection condition for any of these.
This commit is contained in:
Rachel Rice 2021-10-05 14:08:40 +01:00
parent 201708c097
commit 4ae3ece314
No known key found for this signature in database
GPG Key ID: A6DA98BA5E9E2C85
2 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
rules/cloud/aws/aws_attached_malicious_lambda_layer.yml
View File

@ -11,8 +11,13 @@ logsource:
detection:
selection:
eventSource: lambda.amazonaws.com
filter1:
eventName: UpdateFunctionConfiguration
condition: selection
filter2:
eventName: UpdateFunctionConfiguration20150331
filter3:
eventName: UpdateFunctionConfiguration20150331v2
condition: selection and (filter1 or filter2 or filter3)
level: medium
tags:
- attack.privilege_escalation

2
rules/cloud/aws/aws_suspicious_saml_activity.yml
View File

@ -12,7 +12,7 @@ logsource:
detection:
selection1:
eventSource: sts.amazonaws.com
eventName: Assumerolewithsaml
eventName: AssumeRoleWithSAML
selection2:
eventSource: iam.amazonaws.com
eventName: UpdateSAMLProvider