minor fixes (#21)

adanalvarez · Oct 14, 2024 · 638e136 · 638e136
1 parent 341c5dc
commit 638e136
Show file tree

Hide file tree

Showing 232 changed files with 10,585 additions and 11,062 deletions.
diff --git a/docs/datadog_dashboard.json b/docs/datadog_dashboard.json
diff --git a/docs/events.csv b/docs/events.csv
diff --git a/docs/events.json b/docs/events.json
diff --git a/events/ACMPCA/GetCertificate.json b/events/ACMPCA/GetCertificate.json
@@ -9,9 +9,7 @@
     "mitreAttackTechniques": [
         "T1040 - Network Sniffing"
     ],
-    "mitreAttackSubTechniques": [
-
-    ],
+    "mitreAttackSubTechniques": [],
     "unverifiedMitreAttackTechniques": [
         {
             "technique": "T1119 - Automated Collection",

diff --git a/events/ACMPCA/IssueCertificate.json b/events/ACMPCA/IssueCertificate.json
@@ -9,9 +9,7 @@
     "mitreAttackTechniques": [
         "T1040 - Network Sniffing"
     ],
-    "mitreAttackSubTechniques": [
-
-    ],
+    "mitreAttackSubTechniques": [],
     "unverifiedMitreAttackTechniques": [
         {
             "technique": "T1078- Valid Accounts",

diff --git a/events/AppSync/CreateApiKey.json b/events/AppSync/CreateApiKey.json
@@ -11,9 +11,7 @@
         "T1578 - Modify Cloud Compute Infrastructure",
         "T1556 - Modify Authentication Process"
     ],
-    "mitreAttackSubTechniques": [
-
-    ],
+    "mitreAttackSubTechniques": [],
     "unverifiedMitreAttackTechniques": [
         {
             "technique": "T1078 - Valid Accounts",

diff --git a/events/AppSync/GetIntrospectionSchema.json b/events/AppSync/GetIntrospectionSchema.json
@@ -9,9 +9,7 @@
     "mitreAttackTechniques": [
         "T1526 - Cloud Service Discovery"
     ],
-    "mitreAttackSubTechniques": [
-
-    ],
+    "mitreAttackSubTechniques": [],
     "unverifiedMitreAttackTechniques": [
         {
             "technique": "T1087 - Account Discovery",

diff --git a/events/AppSync/UpdateGraphqlApi.json b/events/AppSync/UpdateGraphqlApi.json
@@ -11,9 +11,7 @@
         "T1578 - Modify Cloud Compute Infrastructure",
         "T1556 - Modify Authentication Process"
     ],
-    "mitreAttackSubTechniques": [
-
-    ],
+    "mitreAttackSubTechniques": [],
     "unverifiedMitreAttackTechniques": [
         {
             "technique": "T1136 - Create Account",

diff --git a/events/AppSync/UpdateResolver.json b/events/AppSync/UpdateResolver.json
@@ -11,12 +11,10 @@
         "T1578 - Modify Cloud Compute Infrastructure",
         "T1556 - Modify Authentication Process"
     ],
-    "mitreAttackSubTechniques": [
-
-    ],
+    "mitreAttackSubTechniques": [],
     "unverifiedMitreAttackTechniques": [
         {
-            "technique":  "T1136 - Create Account",
+            "technique": "T1136 - Create Account",
             "reason": "Using the UpdateResolver API, an adversary can manipulate the AppSync resolver to create new user accounts with specific roles or permissions, enabling persistent access to the AWS environment."
         },
         {

diff --git a/events/Athena/GetQueryResults.json b/events/Athena/GetQueryResults.json
@@ -7,11 +7,9 @@
         "TA0007 - Discovery"
     ],
     "mitreAttackTechniques": [
-        "T1580 - Cloud Infrastructure Discovery"        
-    ],
-    "mitreAttackSubTechniques": [
-
+        "T1580 - Cloud Infrastructure Discovery"
     ],
+    "mitreAttackSubTechniques": [],
     "unverifiedMitreAttackTechniques": [
         {
             "technique": "T1082 - System Information Discovery",

diff --git a/events/Bedrock/CreateFoundationModelAgreement.json b/events/Bedrock/CreateFoundationModelAgreement.json
@@ -9,9 +9,7 @@
     "mitreAttackTechniques": [
         "T1496 - Resource Hijacking"
     ],
-    "mitreAttackSubTechniques": [
-
-    ],
+    "mitreAttackSubTechniques": [],
     "unverifiedMitreAttackTechniques": [
         {
             "technique": "T1098 - Account Manipulation",

diff --git a/events/Bedrock/GetFoundationModelAvailability.json b/events/Bedrock/GetFoundationModelAvailability.json
@@ -9,9 +9,7 @@
     "mitreAttackTechniques": [
         "T1580 - Cloud Infrastructure Discovery"
     ],
-    "mitreAttackSubTechniques": [
-
-    ],
+    "mitreAttackSubTechniques": [],
     "unverifiedMitreAttackTechniques": [
         {
             "technique": "T1082 - System Information Discovery",

diff --git a/events/Bedrock/GetModelInvocationLoggingConfiguration.json b/events/Bedrock/GetModelInvocationLoggingConfiguration.json
@@ -9,9 +9,7 @@
     "mitreAttackTechniques": [
         "T1580 - Cloud Infrastructure Discovery"
     ],
-    "mitreAttackSubTechniques": [
-
-    ],
+    "mitreAttackSubTechniques": [],
     "unverifiedMitreAttackTechniques": [
         {
             "technique": "T1070 - Indicator Removal",

diff --git a/events/Bedrock/GetUseCaseForModelAccess.json b/events/Bedrock/GetUseCaseForModelAccess.json
@@ -9,9 +9,7 @@
     "mitreAttackTechniques": [
         "T1580 - Cloud Infrastructure Discovery"
     ],
-    "mitreAttackSubTechniques": [
-
-    ],
+    "mitreAttackSubTechniques": [],
     "unverifiedMitreAttackTechniques": [
         {
             "technique": "T1078 - Valid Accounts: Cloud Accounts",

diff --git a/events/Bedrock/InvokeModel.json b/events/Bedrock/InvokeModel.json
@@ -11,9 +11,7 @@
         "T1580 - Cloud Infrastructure Discovery",
         "T1496 - Resource Hijacking"
     ],
-    "mitreAttackSubTechniques": [
-
-    ],
+    "mitreAttackSubTechniques": [],
     "unverifiedMitreAttackTechniques": [
         {
             "technique": "T1020 - Automated Exfiltration",

diff --git a/events/Bedrock/InvokeModelWithResponseStream.json b/events/Bedrock/InvokeModelWithResponseStream.json
@@ -9,9 +9,7 @@
     "mitreAttackTechniques": [
         "T1496 - Resource Hijacking"
     ],
-    "mitreAttackSubTechniques": [
-
-    ],
+    "mitreAttackSubTechniques": [],
     "unverifiedMitreAttackTechniques": [
         {
             "technique": "T1059 - Command and Scripting Interpreter",

diff --git a/events/Bedrock/ListFoundationModelAgreementOffers.json b/events/Bedrock/ListFoundationModelAgreementOffers.json
@@ -9,9 +9,7 @@
     "mitreAttackTechniques": [
         "T1580 - Cloud Infrastructure Discovery"
     ],
-    "mitreAttackSubTechniques": [
-
-    ],
+    "mitreAttackSubTechniques": [],
     "unverifiedMitreAttackTechniques": [
         {
             "technique": "T1591.002 - Gather Victim Org Information: Business Relationships",

diff --git a/events/Bedrock/ListFoundationModels.json b/events/Bedrock/ListFoundationModels.json
@@ -9,9 +9,7 @@
     "mitreAttackTechniques": [
         "T1580 - Cloud Infrastructure Discovery"
     ],
-    "mitreAttackSubTechniques": [
-
-    ],
+    "mitreAttackSubTechniques": [],
     "unverifiedMitreAttackTechniques": [
         {
             "technique": "T1087 - Account Discovery",

diff --git a/events/Bedrock/ListProvisionedModelThroughputs.json b/events/Bedrock/ListProvisionedModelThroughputs.json
@@ -9,9 +9,7 @@
     "mitreAttackTechniques": [
         "T1580 - Cloud Infrastructure Discovery"
     ],
-    "mitreAttackSubTechniques": [
-
-    ],
+    "mitreAttackSubTechniques": [],
     "unverifiedMitreAttackTechniques": [
         {
             "technique": "T1087.004 - Cloud Account",

diff --git a/events/Bedrock/PutFoundationModelEntitlement.json b/events/Bedrock/PutFoundationModelEntitlement.json
@@ -9,9 +9,7 @@
     "mitreAttackTechniques": [
         "T1496 - Resource Hijacking"
     ],
-    "mitreAttackSubTechniques": [
-
-    ],
+    "mitreAttackSubTechniques": [],
     "unverifiedMitreAttackTechniques": [
         {
             "technique": "T1098 - Account Manipulation",

diff --git a/events/Bedrock/PutUseCaseForModelAccess.json b/events/Bedrock/PutUseCaseForModelAccess.json
@@ -9,9 +9,7 @@
     "mitreAttackTechniques": [
         "T1496 - Resource Hijacking"
     ],
-    "mitreAttackSubTechniques": [
-
-    ],
+    "mitreAttackSubTechniques": [],
     "unverifiedMitreAttackTechniques": [
         {
             "technique": "T1078 - Valid Accounts",

diff --git a/events/CloudFormation/CreateStack.json b/events/CloudFormation/CreateStack.json
@@ -9,9 +9,7 @@
     "mitreAttackTechniques": [
         "T1496 - Resource Hijacking"
     ],
-    "mitreAttackSubTechniques": [
-
-    ],
+    "mitreAttackSubTechniques": [],
     "unverifiedMitreAttackTechniques": [
         {
             "technique": "T1136 - Create Account",

diff --git a/events/CloudFront/CreateFunction2020_05_31.json b/events/CloudFront/CreateFunction2020_05_31.json
@@ -9,9 +9,7 @@
     "mitreAttackTechniques": [
         "T1119 - Automated Collection"
     ],
-    "mitreAttackSubTechniques": [
-
-    ],
+    "mitreAttackSubTechniques": [],
     "unverifiedMitreAttackTechniques": [
         {
             "technique": "T1059 - Command and Scripting Interpreter",

diff --git a/events/CloudFront/PublishFunction2020_05_31.json b/events/CloudFront/PublishFunction2020_05_31.json
@@ -9,9 +9,7 @@
     "mitreAttackTechniques": [
         "T1119 - Automated Collection"
     ],
-    "mitreAttackSubTechniques": [
-
-    ],
+    "mitreAttackSubTechniques": [],
     "unverifiedMitreAttackTechniques": [
         {
             "technique": "T1560 - Archive Collected Data",

diff --git a/events/CloudFront/UpdateDistribution2020_05_31.json b/events/CloudFront/UpdateDistribution2020_05_31.json
@@ -9,9 +9,7 @@
     "mitreAttackTechniques": [
         "T1119 - Automated Collection"
     ],
-    "mitreAttackSubTechniques": [
-
-    ],
+    "mitreAttackSubTechniques": [],
     "unverifiedMitreAttackTechniques": [
         {
             "technique": "T1070 - Indicator Removal",

diff --git a/events/CloudTrail/LookupEvents.json b/events/CloudTrail/LookupEvents.json
@@ -9,9 +9,7 @@
     "mitreAttackTechniques": [
         "T1654 - Log Enumeration"
     ],
-    "mitreAttackSubTechniques": [
-
-    ],
+    "mitreAttackSubTechniques": [],
     "unverifiedMitreAttackTechniques": [
         {
             "technique": "T1087 - Account Discovery",

diff --git a/events/CloudTrail/UpdateTrail.json b/events/CloudTrail/UpdateTrail.json
@@ -23,7 +23,7 @@
         },
         {
             "technique": "T1537 - Transfer Data to Cloud Account",
-            "reason" : "Updating trail settings could facilitate the transfer of logs or sensitive data to an attacker-controlled cloud account for exfiltration."
+            "reason": "Updating trail settings could facilitate the transfer of logs or sensitive data to an attacker-controlled cloud account for exfiltration."
         }
     ],
     "usedInWild": true,

diff --git a/events/CloudWatch/CreateLogStream copy.json b/events/CloudWatch/CreateLogStream copy.json
diff --git a/events/CloudWatch/DeleteLogStream.json b/events/CloudWatch/DeleteLogStream.json
@@ -19,7 +19,7 @@
         },
         {
             "technique": "T1485 - Data Destruction",
-            "reason": "The permanent deletion of archived log events constitutes data destruction, impacting the organization’s ability to conduct forensic analysis and understand the scope of an attack."
+            "reason": "The permanent deletion of archived log events constitutes data destruction, impacting the organization\u2019s ability to conduct forensic analysis and understand the scope of an attack."
         }
     ],
     "usedInWild": false,

diff --git a/events/CloudWatch/DescribeLogGroups.json b/events/CloudWatch/DescribeLogGroups.json
@@ -9,9 +9,7 @@
     "mitreAttackTechniques": [
         "T1580 - Cloud Infrastructure Discovery"
     ],
-    "mitreAttackSubTechniques": [
-
-    ],
+    "mitreAttackSubTechniques": [],
     "unverifiedMitreAttackTechniques": [
         {
             "technique": "T1007 - System Service Discovery",

diff --git a/events/CloudWatch/DescribeLogStreams.json b/events/CloudWatch/DescribeLogStreams.json
@@ -9,9 +9,7 @@
     "mitreAttackTechniques": [
         "T1580 - Cloud Infrastructure Discovery"
     ],
-    "mitreAttackSubTechniques": [
-
-    ],
+    "mitreAttackSubTechniques": [],
     "unverifiedMitreAttackTechniques": [
         {
             "technique": "T1087 - Account Discovery",

diff --git a/events/CloudWatch/DescribeSubscriptionFilters.json b/events/CloudWatch/DescribeSubscriptionFilters.json
@@ -9,9 +9,7 @@
     "mitreAttackTechniques": [
         "T1580 - Cloud Infrastructure Discovery"
     ],
-    "mitreAttackSubTechniques": [
-
-    ],
+    "mitreAttackSubTechniques": [],
     "unverifiedMitreAttackTechniques": [
         {
             "technique": "T1087 - Account Discovery",

diff --git a/events/CloudWatch/GetLogRecord.json b/events/CloudWatch/GetLogRecord.json
@@ -9,9 +9,7 @@
     "mitreAttackTechniques": [
         "T1580 - Cloud Infrastructure Discovery"
     ],
-    "mitreAttackSubTechniques": [
-
-    ],
+    "mitreAttackSubTechniques": [],
     "unverifiedMitreAttackTechniques": [
         {
             "technique": "T1087.004 - Account Discovery: Cloud Account",

diff --git a/events/Cognito/GetCredentialsForIdentity.json b/events/Cognito/GetCredentialsForIdentity.json
@@ -21,7 +21,7 @@
             "reason": "Attackers may use credentials obtained from this API to generate session tokens or cookies for web sessions."
         },
         {
-            "technique":  "T1212: Exploitation for Credential Access",
+            "technique": "T1212: Exploitation for Credential Access",
             "reason": "Exploiting the GetCredentialsForIdentity API call can be a direct method to gain credentials."
         },
         {

diff --git a/events/CostExplorer/GetCostAndUsage.json b/events/CostExplorer/GetCostAndUsage.json
@@ -9,9 +9,7 @@
     "mitreAttackTechniques": [
         "T1526 - Cloud Service Discovery"
     ],
-    "mitreAttackSubTechniques": [
-
-    ],
+    "mitreAttackSubTechniques": [],
     "unverifiedMitreAttackTechniques": [
         {
             "technique": "T1082 - System Information Discovery",