Detection rules › By event

AWS-cloudtrail

Event	Rules
CreateTrail	2
DeleteTrail	12
DescribeTrails	1
LookupEvents	1
PutEventSelectors	3
StopLogging	12
UpdateTrail	11
StartLogging	1

CreateTrail

2 detection rules reference this event. View event page.

Elastic (1)

AWS CloudTrail Log Created severity low T1530, T1685, T1685.002

Panther (1)

A CloudTrail Was Created or Updated severity informational T1538

DeleteTrail

12 detection rules reference this event. View event page.

Sigma (3)

Attempt To Delete A CloudTrail Log severity medium T1685, T1685.002
AWS CloudTrail Important Change severity medium T1685, T1685.002
CloudTrail Log Deleted severity medium T1685, T1685.002

Elastic (1)

AWS CloudTrail Log Deleted severity medium T1685, T1685.002

Splunk (2)

ASL AWS Defense Evasion Delete Cloudtrail severity medium T1685, T1685.002
AWS Defense Evasion Delete Cloudtrail severity medium T1685, T1685.002

Kusto (3)

AWSCloudTrail - Changes made to AWS CloudTrail logs severity low T1070
AWSCloudTrail - Config Service Resource Deletion Attempts severity low T1685, T1685.002
AWSCloudTrail - Tampering to AWS CloudTrail logs severity high T1685, T1685.002

YARA-L (1)

AWS CloudTrail Logging Tampered severity high T1685, T1685.002

Panther (2)

Account Security Configuration Changed severity medium T1685
CloudTrail Stopped severity medium T1685

DescribeTrails

1 detection rules reference this event. View event page.

Elastic (1)

AWS Discovery API Calls from VPN ASN for the First Time by Identity severity high T1526, T1580

LookupEvents

1 detection rules reference this event. View event page.

Elastic (1)

AWS Discovery API Calls from VPN ASN for the First Time by Identity severity high T1526, T1580

PutEventSelectors

3 detection rules reference this event. View event page.

Elastic (1)

AWS CloudTrail Management Events Disabled via PutEventSelectors severity medium T1685, T1685.002

YARA-L (1)

AWS CloudTrail Logging Tampered severity high T1685, T1685.002

Panther (1)

CloudTrail Event Selectors Disabled severity medium T1685

StopLogging

12 detection rules reference this event. View event page.

Sigma (3)

Attempt To Stop CloudTrail Logging severity medium T1685, T1685.002
AWS CloudTrail Important Change severity medium T1685, T1685.002
CloudTrail Logging Stopped severity high T1685, T1685.002

Elastic (1)

AWS CloudTrail Log Suspended severity high T1685, T1685.002

Splunk (2)

ASL AWS Defense Evasion Stop Logging Cloudtrail severity medium T1685, T1685.002
AWS Defense Evasion Stop Logging Cloudtrail severity medium T1685, T1685.002

Kusto (3)

AWSCloudTrail - Changes made to AWS CloudTrail logs severity low T1070
AWSCloudTrail - Config Service Resource Deletion Attempts severity low T1685, T1685.002
AWSCloudTrail - Tampering to AWS CloudTrail logs severity high T1685, T1685.002

YARA-L (1)

AWS CloudTrail Logging Tampered severity high T1685, T1685.002

Panther (2)

Account Security Configuration Changed severity medium T1685
CloudTrail Stopped severity medium T1685

UpdateTrail

11 detection rules reference this event. View event page.

Sigma (3)

Attempt To Modify CloudTrail Log Settings severity medium T1685, T1685.002
AWS CloudTrail Important Change severity medium T1685, T1685.002
CloudTrail Log Settings Modified severity high T1685, T1685.002

Elastic (1)

AWS CloudTrail Log Updated severity high T1530, T1565, T1565.001, T1685, T1685.002

Splunk (2)

ASL AWS Defense Evasion Update Cloudtrail severity medium T1685, T1685.002
AWS Defense Evasion Update Cloudtrail severity medium T1685, T1685.002

Kusto (3)

AWSCloudTrail - Changes made to AWS CloudTrail logs severity low T1070
AWSCloudTrail - Config Service Resource Deletion Attempts severity low T1685, T1685.002
AWSCloudTrail - Tampering to AWS CloudTrail logs severity high T1685, T1685.002

YARA-L (1)

AWS CloudTrail Logging Tampered severity high T1685, T1685.002

Panther (1)

A CloudTrail Was Created or Updated severity informational T1538

StartLogging

1 detection rules reference this event. View event page.

Panther (1)

A CloudTrail Was Created or Updated severity informational T1538