AWS Security Group Allowing All IPs
Detects when the aws command line binary is used to create an address group with a 0.0.0.0 IP, which means any IP address. This action would expose services to the internet and is used by adversaries to allow access to compromised systems.
YARA-L
