enumerate AWS CloudTrail

rule:
  meta:
    name: enumerate AWS CloudTrail
    namespace: host-interaction/cloud/aws
    authors:
      - maximemorin@google.com
    scopes:
      static: function
      dynamic: call
    att&ck:
      - Discovery::Cloud Service Discovery [T1526]
    references:
      - https://unit42.paloaltonetworks.com/teamtnt-operations-cloud-environments/
      - https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/index.html
  features:
    - or:
      - string: "aws cloudtrail describe-trails"
      - string: "aws cloudtrail list-public-keys"