Tag
Detection of Rare AWS SNS Protocol Subscriptions
4 TTPsAdversaries may exploit AWS SNS by subscribing to topics using rare or unauthorized protocols to exfiltrate sensitive data or establish command-and-control communication channels.
AWS SNS Rare Protocol Subscription by User
2 rules 4 TTPsA user subscribing to an SNS topic using a new protocol may indicate data exfiltration or unauthorized access by an adversary aiming to collect sensitive information or exfiltrate data.
AWS SNS Topic Message Publish by Rare User
2 rules 4 TTPsThis rule identifies when an SNS topic message is published by a rare user in AWS, which may indicate lateral movement, data exfiltration, or phishing campaigns, potentially leading to resource hijacking and impact on cloud services.
AWS SNS Topic Created by Rare User
2 rules 2 TTPsAn AWS SNS topic was created by a user who does not typically perform this action, potentially indicating resource development for data exfiltration or other malicious activities.