Lists_the_instance_profiles_that_have_the_specified_associated_IAM_role_AWS_Macie

Alert

Lists the instance profiles that have the specified associated IAM role (ALERT_UPDATED)

SK4 unified event:
Connector/Service

AWS/Macie

SK4 Version:

2.3.105

Created Date:

Sun Feb 17 2019 12:35:54 GMT+0000 (Coordinated Universal Time)

Last Update:

Tue Jun 18 2019 11:11:51 GMT+0000 (Coordinated Universal Time)

Category

Security Alert

Description

An information collection activity suggesting the start of a reconnaissance or exfiltration campaign lists the names of the inline policies that are embedded in the specified IAM role.

Search query

cef_vendor="skyformation" cef_name="security-threat-detected" destinationServiceName="AWS" sourceServiceName="aws.macie" proto="Lists the instance profiles that have the specified associated IAM role*"

Parsed CEF
Unparsed raw data

Expand to see an example...

Audit sources