diff --git a/datasets/attack_techniques/T1098.003/aws_iam_role_created_with_external_trust/aws_iam_role_created_with_external_trust.json b/datasets/attack_techniques/T1098.003/aws_iam_role_created_with_external_trust/aws_iam_role_created_with_external_trust.json new file mode 100644 index 000000000..375f49d54 --- /dev/null +++ b/datasets/attack_techniques/T1098.003/aws_iam_role_created_with_external_trust/aws_iam_role_created_with_external_trust.json @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:78afdd5eac72d57e581137283274310161281ecc9a1c0c8c94adfcad3d30cb23 +size 1325 diff --git a/datasets/attack_techniques/T1098.003/aws_iam_role_created_with_external_trust/aws_iam_role_created_with_external_trust.yml b/datasets/attack_techniques/T1098.003/aws_iam_role_created_with_external_trust/aws_iam_role_created_with_external_trust.yml new file mode 100644 index 000000000..20de4ed5d --- /dev/null +++ b/datasets/attack_techniques/T1098.003/aws_iam_role_created_with_external_trust/aws_iam_role_created_with_external_trust.yml @@ -0,0 +1,16 @@ +author: Maria Jose Erquiaga, Splunk +id: 4671474A-30E9-4E05-A33A-AEC49E0B5079 +date: '2026-10-12' +description: > + Successful AWS IAM CreateRole events with trust policies allowing + sts:AssumeRole by an external AWS account or a wildcard AWS principal. + Contains two positive detection examples. +environment: custom +directory: aws_iam_role_created_with_external_trust +mitre_technique: + - T1098.003 +datasets: + - name: aws_iam_role_created_with_external_trust + path: /datasets/attack_techniques/T1098.003/aws_iam_role_created_with_external_trust/aws_iam_role_created_with_external_trust.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1555.006/aws_anomalous_secrets_manager_batch_retrieval/aws_anomalous_secrets_manager_batch_retrieval.json b/datasets/attack_techniques/T1555.006/aws_anomalous_secrets_manager_batch_retrieval/aws_anomalous_secrets_manager_batch_retrieval.json index 0b53328fd..a7be02d56 100644 --- a/datasets/attack_techniques/T1555.006/aws_anomalous_secrets_manager_batch_retrieval/aws_anomalous_secrets_manager_batch_retrieval.json +++ b/datasets/attack_techniques/T1555.006/aws_anomalous_secrets_manager_batch_retrieval/aws_anomalous_secrets_manager_batch_retrieval.json @@ -1,3 +1,3 @@ version https://git-lfs.github.com/spec/v1 -oid sha256:8291e7361c0132f7d4a79a4c697312cfa2e30ca3bae9baefc4166bcf605e1c63 -size 1523 +oid sha256:d610a9f77cdc042be6ac01f5cf7782b9fd420118df5bc90d59aa94baac0f5f06 +size 19582 diff --git a/datasets/attack_techniques/T1578.005/aws_ec2_startup_script_modification/aws_ec2_startup_script_modification.json b/datasets/attack_techniques/T1578.005/aws_ec2_startup_script_modification/aws_ec2_startup_script_modification.json new file mode 100644 index 000000000..3da009634 --- /dev/null +++ b/datasets/attack_techniques/T1578.005/aws_ec2_startup_script_modification/aws_ec2_startup_script_modification.json @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:5192f1accc48e2608a54f8e413264ba5b31dbeee01b9efada6ee596d5c5126be +size 3367 diff --git a/datasets/attack_techniques/T1578.005/aws_ec2_startup_script_modification/aws_ec2_startup_script_modification.yml b/datasets/attack_techniques/T1578.005/aws_ec2_startup_script_modification/aws_ec2_startup_script_modification.yml new file mode 100644 index 000000000..a4fea186f --- /dev/null +++ b/datasets/attack_techniques/T1578.005/aws_ec2_startup_script_modification/aws_ec2_startup_script_modification.yml @@ -0,0 +1,16 @@ +author: Maria Jose Erquiaga, Splunk +id: 85062c20-6b3e-438a-a17c-1d953c2dedb4 +date: '2026-10-07' +description: >- + CloudTrail events from a successful EC2 StopInstances request followed by a + successful ModifyInstanceAttribute request targeting userData on the same + instance, by the same IAM principal, within one hour. Modification of user + data does not by itself confirm that the script executed. +environment: aws_ec2_test_instance +mitre_technique: +- T1578.005 +datasets: +- name: aws_ec2_startup_script_modification-json + path: /datasets/attack_techniques/T1578.005/aws_ec2_startup_script_modification/aws_ec2_startup_script_modification.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail