Repository navigation
Conversation
….yml updating "how to implement" section
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9e04e6de5d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9e04e6de5d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
….yml Group EC2 key uploads by AWS identity and count unique API events
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1bf2a1028f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| principal_json=json_extract(statements, "Principal") | ||
| | eval actions=if(match(actions_json, "^\s*\["), json_array_to_mv(actions_json, true()), actions_json) | ||
| | mvexpand actions | ||
| | where effect="Allow" AND actions="sts:AssumeRole" |
There was a problem hiding this comment.
When an external trust statement uses a valid wildcard action such as "sts:*" or "*", it still grants sts:AssumeRole, but this exact equality check discards the statement. An attacker can therefore create the external-trust role described by this detection without producing a result; the action test needs to account for IAM wildcard matching rather than only the canonical literal.
Useful? React with 👍 / 👎.
….yml since we are using "user_arn" in the detection, we should also use it in finding
Modified detection to handle wildcard IAM actions in external role trust detection
replaced "actor" by "user_arn" for userIdentity.arn field
This branch has not been deployed
3 participants
Adds an AWS CloudTrail behavioral detection for 10 or more successful EC2 Instance Connect SendSSHPublicKey calls by a single identity. The detection uses CIM-compatible fields and includes validated attack data and a passing unit test.