Rules Contributing to Suspicious AWS VPC Mirror Session Activity
The following rules are used to identify suspicious AWS VPC mirror session activity. Any one or more of these will trigger Suspicious AWS VPC Mirror Session Alert. Details for each rule can be viewed by clicking the More Details link in the description.
Title |
Description |
||||||||
---|---|---|---|---|---|---|---|---|---|
Update VPC Mirror created |
A VPC mirror session has been created. More details
Rule IDQuery{'selection1': {'eventSource': 'ec2.amazonaws.com'}, 'selection2': {'eventName': 'CreateTrafficMirrorSession'}, 'selection3': {'userIdentity_sessionContext_sessionIssuer_userName': ''}, 'condition': 'selection1 and selection2 and not selection3'} Log SourceStellar Cyber AWS configured. Rule SourceDeveloped internally by Stellar Cyber Tactics, Techniques, and ProceduresReferences
N/A
Additional Information
|
||||||||
Update VPC Mirror deleted |
A VPC mirror session has been deleted. More details
Rule IDQuery{'selection1': {'eventSource': 'ec2.amazonaws.com'}, 'selection2': {'eventName': 'DeleteTrafficMirrorSession'}, 'selection3': {'eventName': 'DeleteTrafficMirrorTarget'}, 'selection4': {'eventName': 'DeleteTrafficMirrorFilter'}, 'selection5': {'userIdentity_sessionContext_sessionIssuer_userName': ''}, 'condition': 'selection1 and (selection2 or selection3 or selection4) and not selection5'} Log SourceStellar Cyber AWS configured. Rule SourceDeveloped internally by Stellar Cyber Tactics, Techniques, and ProceduresReferences
N/A
Additional Information
|