Hub configuration

Name: AWS API unauthorized calls
Author: crowdsecurity

More info

AWS API unauthorized calls Detection Scenario by crowdsecurity | CrowdSec Hub

« AWS API unauthorized calls »
v0.4 by crowdsecurity / aws-cis-benchmark-unauthorized-call
Attack scenarioawsNot spoofableHigh confidence

Detect AWS API unauthorized calls

Installation

cscli scenarios install crowdsecurity/aws-cis-benchmark-unauthorized-call

Description

Detect unauthorized AWS API calls based on cloudtrail logs (Section 3.1 of CIS AWS Foundation Benchmark 1.2.0 ).

YAML Configuration

1type: trigger
2name: crowdsecurity/aws-cis-benchmark-unauthorized-call
3description: "Detect AWS API unauthorized calls"
4filter: |
5     evt.Meta.log_type == 'aws-cloudtrail' &&
6     (
7          (evt.Unmarshaled.cloudtrail.errorCode != nil && evt.Unmarshaled.cloudtrail.errorCode matches ".*UnauthorizedOperation$") ||
8          (evt.Unmarshaled.cloudtrail.errorCode != nil && evt.Unmarshaled.cloudtrail.errorCode matches "^AccessDenied.*")
9     )
10labels:
11     confidence: 3
12     spoofable: 0
13     classification:
14          - attack.T1212
15     behavior: "cloud:audit"
16     label: "AWS API unauthorized calls"
17     service: aws
18     cti: false
19     remediation: false
20

Hub configuration

« AWS API unauthorized calls »v0.4 by crowdsecurity / aws-cis-benchmark-unauthorized-callAttack scenarioawsNot spoofableHigh confidenceMITRE:T1212

« AWS API unauthorized calls »
v0.4 by crowdsecurity / aws-cis-benchmark-unauthorized-call
Attack scenarioawsNot spoofableHigh confidence