Has anyone experienced your retro hunts not returning any results? However, when you perform a UDM Search, the results are there.
Example UDM query: (This returns results )
metadata.product_name = "AWS_CLOUDTRAIL" and target.application = "ec2-instance-connect.amazonaws.com" AND principal.user.user_display_name != /(?i)^.*example.*$/
Example Yara-L Detection: (This does not return results )
rule aws_ec2_ssh_key_uploaded{
meta:
author = "test"
description = `Example Detection`
data_source = "AWS CloudTrail"
severity = "High"
events:
$aws.metadata.product_name = "AWS_Cloudtrail"
$aws.target.application = "ec2-instance-connect.amazonaws.com"
$aws.principal.user.user_display_name != /(?i)^.*example.*$/
{
$aws.metadata.product_event_type = "SendSSHPublicKey" OR
$aws.metadata.product_event_type = "SendSerialConsoleSSHPublic"
}
outcome:
$principal_ip = array_distinct($aws.principal.ip)
$user_arn = array_distinct($aws.principal.user.userid)
$action = array_distinct($aws.metadata.product_event_type)
$target_resource_name = array_distinct($aws.target.resource.name)
$network_http_user_agent = array_distinct($aws.network.http.user_agent)
$aws_account = array_distinct($aws.principal.group.product_object_id)
$aws_region = array_distinct($aws.principal.location.name)
condition:
$aws
}
