Skip to content

Instantly share code, notes, and snippets.

@goodycy3

goodycy3/Hunting for a CloudTrail disruption.csv

Created February 6, 2024 17:12
Show Gist options
  • Save goodycy3/666b85ec5534872abf2bea1ccda9e2a3 to your computer and use it in GitHub Desktop.
Save goodycy3/666b85ec5534872abf2bea1ccda9e2a3 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
Hunting for a CloudTrail disruption.csv
event_time errorMessage user_arn source_ip eventName userAgent awsRegion
2019-06-07 11:04:25.000 UTC User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: cloudtrail:StopLogging on resource: arn:aws:cloudtrail:us-east-1:745598359964:trail/summitroute-logs arn:aws:iam::811596193553:user/Level6 2.251.2.5 StopLogging aws-cli/1.16.168 Python/3.7.3rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.158 us-east-1
2019-06-07 11:04:25.000 UTC User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: cloudtrail:StopLogging on resource: arn:aws:cloudtrail:us-east-1:745598359964:trail/summitroute-logs arn:aws:iam::811596193553:user/Level6 2.251.2.5 StopLogging aws-cli/1.16.168 Python/3.7.3rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.158 us-east-1
2017-08-03 19:50:59.000 UTC User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: cloudtrail:UpdateTrail on resource: arn:aws:cloudtrail:us-west-2:811596193553:trail/cloudtrail arn:aws:iam::811596193553:user/Level6 9.95.19.14 UpdateTrail aws-cli/1.11.118 Python/2.7.10 Darwin/16.6.0 botocore/1.5.81 us-west-2
2019-08-23 15:48:50.000 UTC arn:aws:iam::811596193553:root 228.139.46.252 DeleteTrail console.amazonaws.com us-west-2
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment