218007301253_CloudTrail_us-east-1_20230710T1225Z_qWyTCPHzELqDMshA.json

{"Records":[{"eventVersion":"1.08","userIdentity":{"type":"IAMUser","principalId":"AIDATFQR7NSC5AU2ZV3IE","arn":"arn:aws:iam::123837392027:user/bert-jan","accountId":"123837392027","accessKeyId":"ASIATFQR7NSCXEPZ2TWK","userName":"bert-jan","sessionContext":{"sessionIssuer":{},"webIdFederationData":{},"attributes":{"creationDate":"2023-07-10T12:13:16Z","mfaAuthenticated":"true"}}},"eventTime":"2023-07-10T12:18:30Z","eventSource":"health.amazonaws.com","eventName":"DescribeEventAggregates","awsRegion":"us-east-1","sourceIPAddress":"10.8.8.10","userAgent":"AWS Internal","requestParameters":{"aggregateField":"eventTypeCategory","filter":{"eventStatusCodes":["open","upcoming"],"startTimes":[{"from":"Jul 3, 2023 12:18:30 PM"}]}},"responseElements":null,"requestID":"f4f433b1-24d8-47e0-97d8-c30896fda554","eventID":"b3fc36ad-5b43-48ee-b175-4e58d3bee1bd","readOnly":true,"eventType":"AwsApiCall","managementEvent":true,"recipientAccountId":"123837392027","eventCategory":"Management","sessionCredentialFromConsole":"true"},{"eventVersion":"1.08","userIdentity":{"type":"IAMUser","principalId":"AIDATFQR7NSC5AU2ZV3IE","arn":"arn:aws:iam::123837392027:user/bert-jan","accountId":"123837392027","accessKeyId":"AKIATFQR7NSC8Q4X20BJ","userName":"bert-jan"},"eventTime":"2023-07-10T12:22:05Z","eventSource":"rds.amazonaws.com","eventName":"ListTagsForResource","awsRegion":"us-east-1","sourceIPAddress":"192.168.10.20","userAgent":"APN/1.0 HashiCorp/1.0 Terraform/1.1.2 (+https://www.terraform.io) terraform-provider-aws/3.76.1 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go/1.44.157 (go1.19.3; linux; amd64) stratus-red-team_06a62bf9-ef89-43a1-a17b-5234dcbf4cb4 HashiCorp-terraform-exec/0.17.3","requestParameters":{"resourceName":"arn:aws:rds:us-east-1:123837392027:snapshot:exfiltration"},"responseElements":null,"requestID":"14c37953-2b81-4bb1-93af-b4afbecd01a6","eventID":"a3ae61ee-9f1b-4290-86fc-8e6cbf533c69","readOnly":true,"eventType":"AwsApiCall","managementEvent":true,"recipientAccountId":"123837392027","eventCategory":"Management","tlsDetails":{"tlsVersion":"TLSv1.2","cipherSuite":"ECDHE-RSA-AES128-GCM-SHA256","clientProvidedHostHeader":"rds.us-east-1.amazonaws.com"}},{"eventVersion":"1.08","userIdentity":{"type":"IAMUser","principalId":"AIDATFQR7NSC5AU2ZV3IE","arn":"arn:aws:iam::123837392027:user/bert-jan","accountId":"123837392027","accessKeyId":"AKIATFQR7NSC8Q4X20BJ","userName":"bert-jan"},"eventTime":"2023-07-10T12:22:40Z","eventSource":"s3.amazonaws.com","eventName":"GetBucketTagging","awsRegion":"us-east-1","sourceIPAddress":"192.168.10.20","userAgent":"[APN/1.0 HashiCorp/1.0 Terraform/1.1.2 (+https://www.terraform.io) terraform-provider-aws/3.76.1 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go/1.44.157 (go1.19.3; linux; amd64) stratus-red-team_0362e208-cc47-4ba7-9c39-195518d6e937 HashiCorp-terraform-exec/0.17.3]","requestParameters":{"tagging":"","bucketName":"stratus-red-team-bdbp-lhfzvgcamn","Host":"stratus-red-team-bdbp-lhfzvgcamn.s3.amazonaws.com"},"responseElements":null,"additionalEventData":{"SignatureVersion":"SigV4","CipherSuite":"ECDHE-RSA-AES128-GCM-SHA256","bytesTransferredIn":0,"AuthenticationMethod":"AuthHeader","x-amz-id-2":"gXhN5h7mLR7WRKX8OgrKa6gaQGbc8zB/G7PFfZUQSnhKBd5opnQQy01TInp0/gFpI9Ik4F3G/Qk=","bytesTransferredOut":178},"requestID":"EQ585D3263NQAMPE","eventID":"ba43cac2-dde1-4893-b539-d81c9932152f","readOnly":true,"resources":[{"accountId":"123837392027","type":"AWS::S3::Bucket","ARN":"arn:aws:s3:::stratus-red-team-bdbp-lhfzvgcamn"}],"eventType":"AwsApiCall","managementEvent":true,"recipientAccountId":"123837392027","eventCategory":"Management","tlsDetails":{"tlsVersion":"TLSv1.2","cipherSuite":"ECDHE-RSA-AES128-GCM-SHA256","clientProvidedHostHeader":"stratus-red-team-bdbp-lhfzvgcamn.s3.amazonaws.com"}},{"eventVersion":"1.08","userIdentity":{"type":"IAMUser","principalId":"AIDATFQR7NSC5U6Q3TMDR","arn":"arn:aws:iam::123837392027:user/benjamin","accountId":"123837392027","accessKeyId":"ASIATFQR7NSCX6ILTQHM","userName":"benjamin","sessionContext":{"sessionIssuer":{},"webIdFederationData":{},"attributes":{"creationDate":"2023-07-10T11:42:31Z","mfaAuthenticated":"true"}}},"eventTime":"2023-07-10T12:22:47Z","eventSource":"health.amazonaws.com","eventName":"DescribeEventAggregates","awsRegion":"us-east-1","sourceIPAddress":"10.248.16.43","userAgent":"AWS Internal","requestParameters":{"aggregateField":"eventTypeCategory","filter":{"eventStatusCodes":["open","upcoming"],"startTimes":[{"from":"Jul 3, 2023 12:22:47 PM"}]}},"responseElements":null,"requestID":"a541747b-b631-43cd-9c54-4a3e077e3448","eventID":"89990b94-1c09-4bff-a85c-99eb76e19583","readOnly":true,"eventType":"AwsApiCall","managementEvent":true,"recipientAccountId":"123837392027","eventCategory":"Management","sessionCredentialFromConsole":"true"}]}