valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 01:45:21 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #1977 from rachelrice/update_aws_assumerole

Browse Source 
Update AWS STS AssumeRole Misuse rule
This commit is contained in:
frack113 2021-09-03 08:11:52 +02:00 committed by GitHub
commit b0f8275f72
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
rules/cloud/aws/aws_sts_assumerole_misuse.yml
View File

@ -12,8 +12,7 @@ logsource:
service: cloudtrail
detection:
selection:
eventSource: sts.amazonaws.com
eventName: AssumeRole
userIdentity.type: AssumedRole
userIdentity.sessionContext.sessionIssuer.type: Role
condition: selection
level: low