Possible AWS Glue Development Endpoint Behavior (via cloudtrail)

title: Possible AWS Glue Development Endpoint Behavior (via cloudtrail)
id: e4f0140a-c432-5592-81f6-c9846bd0ad12
status: stable
description: This rule detects possible anomalous glue development endpoint activity.
references:
    - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/
    - https://docs.aws.amazon.com/glue/latest/webapi/API_CreateDevEndpoint.html
author: Huntrule Team
date: 2026-04-28
tags:
    - attack.privilege-escalation
    - attack.t1078.004
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'glue.amazonaws.com'
        eventName:
            - 'CreateDevEndpoint'
            - 'DeleteDevEndpoint'
            - 'UpdateDevEndpoint'
    condition: selection
falsepositives:
    - Unknown
level: low