Update aws_enum_listing.yml

2024-11-07 01:45:21 +00:00 · 2020-11-22 01:05:56 +08:00 · 2020-11-22 01:05:56 +08:00 · 52fca0fe3a
commit 52fca0fe3a
parent e764ca687a
1 changed files with 3 additions and 2 deletions
--- a/rules/cloud/aws_enum_listing.yml
+++ b/rules/cloud/aws_enum_listing.yml
@ -10,8 +10,9 @@ detection:
    selection_eventname:
        - eventName: list*
    timeframe: 10m
-    condition: count() by userIdentity.arn > 50  
-
+    condition: count() by "userIdentity.arn" > 50  
+fields:
+    - userIdentity.arn
 falsepositives:
    - AWS Config or other configuration scanning activities
 level: low