Query: Sigma rule for Detects potentially suspicious events involving "GetSigninToken". An adversary using the "aws_consoler" tool can leverag
Matching passage: Sigma rule: Detects potentially suspicious events involving "GetSigninToken". An adversary using the "aws_consoler" tool can leverag. Logsource: aws / cloudtrail. Rule: title: AWS Console GetSigninToken Potential Abuse id: f8103686-e3e8-46f3-be72-65f7fcb4aa53 status: test description: 'Detects potentially suspicious events involving "GetSigninToken". An adversary using the "aws_consoler" tool can leverage this console API to create temporary federated credential that help obfuscate which AWS credential is compromised (the original access key) and enables the adversary to pivot from the AWS CLI to console sessions without the need for MFA using the new access key issued in this request. ' references: - https://github.com/NetSPI/aws_consoler - https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/ author: Chester Le Bron (@123Le_Bron) date: 2024-02-26 tags: - attack.lateral-movement - attack.t1021.007 - attack.t1550.001 logsource: product: aws service: cloudtrail detection: selection: eventSource: signin.amazonaws.com eventName: GetSigninToken filter_main_console_ua: userAgent|contains: Jersey/${project.version} condition: selection and not 1 of filter_main_* falsepositives: - GetSigninToken events will occur when using AWS SSO portal to login and will generate false positives if you do not filter for the expected user agent(s), see filter. Non-SSO configured roles would be abnormal and should be investigated. level: medium
Near-miss passage: Sigma rule: Detects potential SQL injection attempts via GET requests in access logs.. Logsource: webserver. Rule: title: SQL Injection Strings In URI id: 5513deaf-f49a-46c2-a6c8-3f111b5cb453 status: test description: Detects potential SQL injection attempts via GET requests in access logs. references: - https://www.acunetix.com/blog/articles/exploiting-sql-injection-example/ - https://www.acunetix.com/blog/articles/using-logs-to-investigate-a-web-application-attack/ - https://brightsec.com/blog/sql-injection-payloads/ - https://github.com/payloadbox/sql-injection-payload-list - https://book.hacktricks.xyz/pentesting-web/sql-injection/mysql-injection author: Saw Win Naung, Nasreddine Bencherchali (Nextron Systems), Thurein Oo (Yoma Bank) date: 2020-02-22 modified: 2023-09-04 tags: - attack.initial-access - attack.t1190 logsource: category: webserver detection: selection: cs-method: GET keywords: - '@@version' - '%271%27%3D%271' - '=select ' - =select( - =select%20 - concat_ws( - CONCAT(0x - from mysql.innodb_table_stats - from%20mysql.innodb_table_stats - group_concat( - information_schema.tables - json_arrayagg( - or 1=1# - or%201=1# - 'order by ' - order%20by%20 - 'select * ' - select database() - select version() - select%20*%20 - select%20database() - select%20version() - select%28sleep%2810%29 - SELECTCHAR( - table_schema - UNION ALL SELECT - UNION SELECT - UNION%20ALL%20SELECT - UNION%20SELECT - '''1''=''1' filter_main_status: sc-status: 404 condition: selection and keywords and not 1 of filter_main_* falsepositives: - Java scripts and CSS Files - User searches in search boxes of the respective website - Internal vulnerability scanners can cause some serious FPs when used, if you experience a lot of FPs due to this think of adding more filters such as "User Agent" strings and more response codes level: high