Techniques
Sample rules
Unusual AWS Command for a User
- source: elastic
- technicques:
Description
A machine learning job detected an AWS API command that, while not inherently suspicious or abnormal, is being made by a user context that does not normally use the command. This can be the result of compromised credentials or keys as someone uses a valid account to persist, move laterally, or exfiltrate data.
Detection logic