cloud

Account Enumeration on AWS

Apr 21, 2023 · attack.discovery attack.t1592 ·

Detects enumeration of accounts configuration via api call to list different instances and services within a short period of time.

AWS EC2 Download Userdata

Apr 21, 2023 · attack.exfiltration attack.t1020 ·

Share on:

Detects bulk downloading of User Data associated with AWS EC2 instances. Instance User Data may include installation scripts and hard-coded secrets for deployment.

AWS Macie Evasion

Apr 21, 2023 · attack.defense_evasion attack.t1562.001 ·

Share on:

Detects evade to Macie detection.

Potential AWS Cloud Email Service Abuse

Apr 21, 2023 · attack.t1583.006 attack.resource_development ·

Share on:

Detects when the email sending feature is enabled for an AWS account and the email address verification request is dispatched in quick succession

Potential Backup Enumeration on AWS

Apr 21, 2023 · attack.discovery attack.t1580 ·

Share on:

Detects potential enumeration activity targeting an AWS instance backups

Potential Network Enumeration on AWS

Apr 21, 2023 · attack.discovery attack.t1016 ·

Share on:

Detects network enumeration performed on AWS.

Potential Storage Enumeration on AWS

Apr 21, 2023 · attack.discovery attack.t1619 ·

Share on:

Detects potential enumeration activity targeting AWS storage

Sign-in Failure Bad Password Threshold

Apr 21, 2023 · attack.credential_access attack.t1110 ·

Share on:

Define a baseline threshold and then monitor and adjust to suit your organizational behaviors and limit false alerts from being generated.