Query: Sigma YAML for aws / cloudtrail
Matching passage: Sigma rule: Detects potentially suspicious events involving "GetSigninToken". An adversary using the "aws_consoler" tool can leverag. Logsource: aws / cloudtrail. Rule: title: AWS Console GetSigninToken Potential Abuse id: f8103686-e3e8-46f3-be72-65f7fcb4aa53 status: test description: 'Detects potentially suspicious events involving "GetSigninToken". An adversary using the "aws_consoler" tool can leverage this console API to create temporary federated credential that help obfuscate which AWS credential is compromised (the original access key) and enables the adversary to pivot from the AWS CLI to console sessions without the need for MFA using the new access key issued in this request. ' references: - https://github.com/NetSPI/aws_consoler - https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/ author: Chester Le Bron (@123Le_Bron) date: 2024-02-26 tags: - attack.lateral-movement - attack.t1021.007 - attack.t1550.001 logsource: product: aws service: cloudtrail detection: selection: eventSource: signin.amazonaws.com eventName: GetSigninToken filter_main_console_ua: userAgent|contains: Jersey/${project.version} condition: selection and not 1 of filter_main_* falsepositives: - GetSigninToken events will occur when using AWS SSO portal to login and will generate false positives if you do not filter for the expected user agent(s), see filter. Non-SSO configured roles would be abnormal and should be investigated. level: medium
Near-miss passage: Sigma rule: Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic".. Logsource: windows / process_creation. Rule: title: Suspicious Eventlog Clearing or Configuration Change Activity id: cc36992a-4671-4f21-a91d-6c2b72a2edf5 status: stable description: 'Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic". This technique were seen used by threat actors and ransomware strains in order to evade defenses. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.001/T1070.001.md - https://eqllib.readthedocs.io/en/latest/analytics/5b223758-07d6-4100-9e11-238cfdd0fe97.html - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil - https://gist.github.com/fovtran/ac0624983c7722e80a8f5a4babb170ee - https://jdhnet.wordpress.com/2017/12/19/changing-the-location-of-the-windows-event-logs/ - https://www.linkedin.com/posts/huntress-labs_when-a-sketchy-incident-hits-your-network-activity-7304940371078238208-Th_l/?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAJTlRcB28IaUtg03HUU-IdliwzoAL1flGc - https://stackoverflow.com/questions/66011412/how-to-clear-a-event-log-in-powershell-7 - https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventlogsession.clearlog?view=windowsdesktop-9.0&viewFallbackFrom=dotnet-plat-ext-5.0#System_Diagnostics_Eventing_Reader_EventLogSession_ClearLog_System_String_ - https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlog.clear author: Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2019-09-26 modified: 2026-06-01 tags: - attack.defense-impairment - attack.t1685.005 - attack.t1685.001 - car.2016-04-002 logsource: category: process_creation product: windows detection: selection_wevtutil_img: - Image|endswith: \wevtutil.exe - OriginalFileName: wevtutil.exe selection_wevtutil_cmd: CommandLine|contains: - 'clear-log ' - ' cl ' - 'set-log ' - ' sl ' - 'lfn:' selection_other_ps_img: Image|endswith: - \powershell.exe - \powershell_ise.exe - \pwsh.exe selection_other_ps_cmd: - CommandLine|contains: - 'Clear-EventLog ' - 'Remove-EventLog ' - 'Limit-EventLog ' - 'Clear-WinEvent ' - CommandLine|contains|all: - Eventing.Reader.EventLogSession - ClearLog - CommandLine|contains|all: - Diagnostics.EventLog - Clear selection_other_wmi: Image|endswith: - \powershell.exe - \powershell_ise.exe - \pwsh.exe - \wmic.exe CommandLine|contains: ClearEventLog filter_main_msiexec: ParentImage: - C:\Windows\SysWOW