Skip to content

Commit d7d1c8e

Browse files
Update rules/integrations/aws/exfiltration_sns_email_subscription_by_rare_user.toml
Co-authored-by: Isai <[email protected]>
1 parent 69dfceb commit d7d1c8e

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

rules/integrations/aws/exfiltration_sns_email_subscription_by_rare_user.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ note = """## Triage and Analysis
2626
2727
### Investigating AWS SNS Email Subscription by Rare User
2828
29-
This rule identifies when an SNS topic is subscribed to by an email address by a user who does not typically perform this action. While subscribing to SNS topics is a common practice, adversaries may exploit this feature to collect sensitive information or exfiltrate data via an external email address.
29+
This rule identifies when an SNS topic is subscribed to by an email address of a user who does not typically perform this action. While subscribing to SNS topics is a common practice, adversaries may exploit this feature to collect sensitive information or exfiltrate data via an external email address.
3030
3131
#### Possible Investigation Steps
3232

0 commit comments

Comments
 (0)