Skip to content

Instantly share code, notes, and snippets.

@invictus-ir

invictus-ir/CloudTrail.csv Secret

Created April 11, 2023 14:13
Show Gist options
  • Star 2 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save invictus-ir/2e892e19aad49eafe449fae91b2ff25b to your computer and use it in GitHub Desktop.
Save invictus-ir/2e892e19aad49eafe449fae91b2ff25b to your computer and use it in GitHub Desktop.
Download ZIP
CloudTrail events
Raw
CloudTrail.csv
eventName Phase Note
ListUsers Reconnaissance Useful usage in your environment might vary due to applications requesting this information
ListBuckets Reconnaissance Useful usage in your environment might vary due to applications requesting this information
ListIdentities Reconnaissance Can be noisy due to applications requesting this information
ListAccessKeys Reconnaissance Can be noisy due to applications requesting this information
ListServiceQuotas Reconnaissance Useful limited to AWS SES so should be rarely used
GetAccount Reconnaissance Can be noisy due to applications requesting this information
GetSendQuota Reconnaissance Useful limited to AWS SES so should be rarely used
CreateUser Persistence Highly useful you should know who is able to create users
GetBucketVersioning Impact Highly useful should be limited usage in your environment
PutBucketVersioning Impact Highly useful should be limited usage in your environment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment