Detection rules › By catalog entry

AWS-cloudtrail

Catalog entry	Rules
CreateTrail	2
DeleteTrail	11
DescribeTrails	1
LookupEvents	1
PutEventSelectors	3
StopLogging	11
UpdateTrail	10
StartLogging	1

CreateTrail

2 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS CloudTrail Log Created severity low T1530,T1685,T1685.002

Panther (1)

A CloudTrail Was Created or Updated severity informational T1538

DeleteTrail

11 detection rules reference this catalog entry. View catalog entry.

Sigma (3)

Attempt To Delete A CloudTrail Log severity medium T1685,T1685.002
AWS CloudTrail Important Change severity medium T1685,T1685.002
CloudTrail Log Deleted severity medium T1685,T1685.002

Elastic (1)

AWS CloudTrail Log Deleted severity medium T1685,T1685.002

Splunk (2)

ASL AWS Defense Evasion Delete Cloudtrail severity medium T1685,T1685.002
AWS Defense Evasion Delete Cloudtrail severity medium T1685,T1685.002

Kusto (2)

AWSCloudTrail - Failed Attempts to Change AWS CloudTrail Logs severity low T1685,T1685.002
AWSCloudTrail - Successful Tampering with AWS CloudTrail Logs severity high T1685,T1685.002

YARA-L (1)

AWS CloudTrail Logging Tampered severity high T1685,T1685.002

Panther (2)

Account Security Configuration Changed severity medium T1685
CloudTrail Stopped severity medium T1685

DescribeTrails

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS Discovery API Calls from VPN ASN for the First Time by Identity severity high T1526,T1580

LookupEvents

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS Discovery API Calls from VPN ASN for the First Time by Identity severity high T1526,T1580

PutEventSelectors

3 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS CloudTrail Management Events Disabled via PutEventSelectors severity medium T1685,T1685.002

YARA-L (1)

AWS CloudTrail Logging Tampered severity high T1685,T1685.002

Panther (1)

CloudTrail Event Selectors Disabled severity medium T1685

StopLogging

11 detection rules reference this catalog entry. View catalog entry.

Sigma (3)

Attempt To Stop CloudTrail Logging severity medium T1685,T1685.002
AWS CloudTrail Important Change severity medium T1685,T1685.002
CloudTrail Logging Stopped severity high T1685,T1685.002

Elastic (1)

AWS CloudTrail Log Suspended severity high T1685,T1685.002

Splunk (2)

ASL AWS Defense Evasion Stop Logging Cloudtrail severity medium T1685,T1685.002
AWS Defense Evasion Stop Logging Cloudtrail severity medium T1685,T1685.002

Kusto (2)

AWSCloudTrail - Failed Attempts to Change AWS CloudTrail Logs severity low T1685,T1685.002
AWSCloudTrail - Successful Tampering with AWS CloudTrail Logs severity high T1685,T1685.002

YARA-L (1)

AWS CloudTrail Logging Tampered severity high T1685,T1685.002

Panther (2)

Account Security Configuration Changed severity medium T1685
CloudTrail Stopped severity medium T1685

UpdateTrail

10 detection rules reference this catalog entry. View catalog entry.

Sigma (3)

Attempt To Modify CloudTrail Log Settings severity medium T1685,T1685.002
AWS CloudTrail Important Change severity medium T1685,T1685.002
CloudTrail Log Settings Modified severity high T1685,T1685.002

Elastic (1)

AWS CloudTrail Log Updated severity high T1530,T1565,T1565.001,T1685,T1685.002

Splunk (2)

ASL AWS Defense Evasion Update Cloudtrail severity medium T1685,T1685.002
AWS Defense Evasion Update Cloudtrail severity medium T1685,T1685.002

Kusto (2)

AWSCloudTrail - Failed Attempts to Change AWS CloudTrail Logs severity low T1685,T1685.002
AWSCloudTrail - Successful Tampering with AWS CloudTrail Logs severity high T1685,T1685.002

YARA-L (1)

AWS CloudTrail Logging Tampered severity high T1685,T1685.002

Panther (1)

A CloudTrail Was Created or Updated severity informational T1538

StartLogging

1 detection rules reference this catalog entry. View catalog entry.

Panther (1)

A CloudTrail Was Created or Updated severity informational T1538

Back to all AWS-cloudtrail catalog entries