Detection rules › By catalog entry

AWS-guardduty

Catalog entry	Rules
CreateIPSet	3
DeleteDetector	3
DeleteInvitations	1
DeleteMembers	1
DeletePublishingDestination	2
DeleteThreatIntelSet	2
DisassociateFromAdministratorAccount	1
DisassociateMembers	1
StopMonitoringMembers	1
UpdateDetector	5
UpdateThreatIntelSet	2
ArchiveFindings	1
CreateThreatIntelSet	1
DeleteIPSet	1
UpdateIPSet	2

CreateIPSet

3 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

AWS GuardDuty Important Change severity high T1685

Elastic (1)

AWS GuardDuty Detection Suppression severity high T1685

Panther (1)

AWS Trusted IPSet Modified severity high T1685

DeleteDetector

3 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

AWS GuardDuty Detector Deleted Or Updated severity high T1685,T1685.002

Elastic (1)

AWS GuardDuty Detector Deletion severity high T1685

Splunk (1)

AWS Defense Evasion Impair Security Services severity medium T1685,T1685.002

DeleteInvitations

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS GuardDuty Member Account Manipulation severity high T1685

DeleteMembers

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS GuardDuty Member Account Manipulation severity high T1685

DeletePublishingDestination

2 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS GuardDuty Publishing Destination Deleted severity medium T1685

YARA-L (1)

AWS GuardDuty Publishing Destination Deleted severity high T1685

DeleteThreatIntelSet

2 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS GuardDuty Threat Intelligence Set Deleted severity medium T1685

YARA-L (1)

AWS GuardDuty Trusted Or Threat IP Lists Tampered severity high T1685

DisassociateFromAdministratorAccount

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS GuardDuty Member Account Manipulation severity high T1685

DisassociateMembers

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS GuardDuty Member Account Manipulation severity high T1685

StopMonitoringMembers

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS GuardDuty Member Account Manipulation severity high T1685

UpdateDetector

5 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

AWS GuardDuty Detector Deleted Or Updated severity high T1685,T1685.002

Elastic (1)

AWS GuardDuty Detection Suppression severity high T1685

Kusto (1)

AWSCloudTrail - AWS GuardDuty detector disabled or suspended severity high T1685

YARA-L (1)

AWS GuardDuty Disabled severity high T1685

Panther (1)

Account Security Configuration Changed severity medium T1685

UpdateThreatIntelSet

2 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS GuardDuty Detection Suppression severity high T1685

YARA-L (1)

AWS GuardDuty Trusted Or Threat IP Lists Tampered severity high T1685

ArchiveFindings

1 detection rules reference this catalog entry. View catalog entry.

Panther (1)

AWS Macie Disabled/Updated severity medium T1685

CreateThreatIntelSet

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS GuardDuty Detection Suppression severity high T1685

DeleteIPSet

1 detection rules reference this catalog entry. View catalog entry.

Splunk (1)

AWS Defense Evasion Impair Security Services severity medium T1685,T1685.002

UpdateIPSet

2 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS GuardDuty Detection Suppression severity high T1685

Panther (1)

AWS Trusted IPSet Modified severity high T1685

Back to all AWS-guardduty catalog entries