Detection rules › By event

AWS-iam

Event	Rules
any	3
AddRoleToInstanceProfile	2
AddUserToGroup	3
AttachGroupPolicy	24
AttachRolePolicy	26
AttachUserPolicy	26
CreateAccessKey	20
CreateGroup	2
CreateInstanceProfile	2
CreateLoginProfile	12
CreateOpenIDConnectProvider	1
CreatePolicyVersion	2
CreateRole	6
CreateSAMLProvider	3
CreateUser	7
CreateVirtualMFADevice	5
DeactivateMFADevice	5
DeleteAccountPasswordPolicy	3
DeleteGroup	4
DeleteLoginProfile	3
DeleteSAMLProvider	3
DeleteVirtualMFADevice	4
EnableMFADevice	2
GetAccountAuthorizationDetails	1
GetAccountSummary	2
GetCredentialReport	1
GetLoginProfile	1
GetPolicy	1
GetPolicyVersion	1
GetRole	1
GetRolePolicy	1
GetUser	1
GetUserPolicy	1
ListAccessKeys	3
ListAccountAliases	2
ListAttachedRolePolicies	2
ListAttachedUserPolicies	2
ListGroups	3
ListMFADevices	1
ListRoles	4
ListUserPolicies	1
ListUsers	3
PutRolePolicy	14
PutUserPolicy	17
SetDefaultPolicyVersion	2
UpdateAccountPasswordPolicy	3
UpdateAssumeRolePolicy	2
UpdateLoginProfile	9
UpdateSAMLProvider	7
ChangePassword	1
CreateServiceLinkedRole	1
CreateServiceSpecificCredential	1
DeleteAccessKey	1
DeleteGroupPolicy	2
DeletePolicy	1
DeleteRole	1
DeleteRolePermissionsBoundary	1
DeleteRolePolicy	1
DeleteServiceSpecificCredential	1
DeleteUser	1
DeleteUserPermissionsBoundary	1
DeleteUserPolicy	1
DetachGroupPolicy	1
DetachRolePolicy	1
DetachUserPolicy	1
GetAccountPasswordPolicy	2
GetGroup	1
GetGroupPolicy	1
ListAttachedGroupPolicies	1
ListGroupPolicies	1
ListGroupsForUser	2
PutGroupPolicy	13
PutRolePermissionsBoundary	1
PutUserPermissionsBoundary	1
RemoveUserFromGroup	1
UploadServerCertificate	1

any

3 detection rules reference this event. View event page.

Elastic (3)

AddRoleToInstanceProfile

2 detection rules reference this event. View event page.

Elastic (2)

AddUserToGroup

3 detection rules reference this event. View event page.

Elastic (2)

Kusto (1)

AttachGroupPolicy

24 detection rules reference this event. View event page.

Sigma (2)

Elastic (2)

Kusto (15)

YARA-L (3)

Panther (2)

AttachRolePolicy

26 detection rules reference this event. View event page.

Sigma (2)

Elastic (4)

Kusto (15)

YARA-L (3)

Panther (2)

AttachUserPolicy

26 detection rules reference this event. View event page.

Sigma (2)

Elastic (4)

Kusto (15)

YARA-L (3)

Panther (2)

CreateAccessKey

20 detection rules reference this event. View event page.

Sigma (4)

Elastic (5)

Splunk (2)

Kusto (2)

YARA-L (4)

Panther (3)

CreateGroup

2 detection rules reference this event. View event page.

Elastic (1)

Kusto (1)

CreateInstanceProfile

2 detection rules reference this event. View event page.

Elastic (2)

CreateLoginProfile

12 detection rules reference this event. View event page.

Sigma (2)

Elastic (4)

Splunk (1)

YARA-L (3)

Panther (2)

CreateOpenIDConnectProvider

1 detection rules reference this event. View event page.

Elastic (1)

CreatePolicyVersion

2 detection rules reference this event. View event page.

Elastic (1)

Splunk (1)

CreateRole

6 detection rules reference this event. View event page.

Elastic (2)

Kusto (1)

YARA-L (1)

Panther (2)

CreateSAMLProvider

3 detection rules reference this event. View event page.

Elastic (1)

YARA-L (1)

Panther (1)

CreateUser

7 detection rules reference this event. View event page.

Sigma (3)

Elastic (3)

Kusto (1)

CreateVirtualMFADevice

5 detection rules reference this event. View event page.

Elastic (1)

Splunk (2)

Kusto (1)

YARA-L (1)

DeactivateMFADevice

5 detection rules reference this event. View event page.

Elastic (1)

Splunk (2)

Kusto (1)

YARA-L (1)

DeleteAccountPasswordPolicy

3 detection rules reference this event. View event page.

Elastic (1)

Splunk (1)

YARA-L (1)

DeleteGroup

4 detection rules reference this event. View event page.

Elastic (1)

Splunk (2)

Kusto (1)

DeleteLoginProfile

3 detection rules reference this event. View event page.

Sigma (1)

Kusto (1)

Panther (1)

DeleteSAMLProvider

3 detection rules reference this event. View event page.

Sigma (1)

YARA-L (1)

Panther (1)

DeleteVirtualMFADevice

4 detection rules reference this event. View event page.

Splunk (2)

Kusto (1)

YARA-L (1)

EnableMFADevice

2 detection rules reference this event. View event page.

Elastic (1)

YARA-L (1)

GetAccountAuthorizationDetails

1 detection rules reference this event. View event page.

Sigma (1)

GetAccountSummary

2 detection rules reference this event. View event page.

Elastic (2)

GetCredentialReport

1 detection rules reference this event. View event page.

Sigma (1)

GetLoginProfile

1 detection rules reference this event. View event page.

Sigma (1)

GetPolicy

1 detection rules reference this event. View event page.

Sigma (1)

GetPolicyVersion

1 detection rules reference this event. View event page.

Sigma (1)

GetRole

1 detection rules reference this event. View event page.

Sigma (1)

GetRolePolicy

1 detection rules reference this event. View event page.

Sigma (1)

GetUser

1 detection rules reference this event. View event page.

Sigma (1)

GetUserPolicy

1 detection rules reference this event. View event page.

Sigma (1)

ListAccessKeys

3 detection rules reference this event. View event page.

Sigma (1)

Elastic (1)

Kusto (1)

ListAccountAliases

2 detection rules reference this event. View event page.

Elastic (2)

ListAttachedRolePolicies

2 detection rules reference this event. View event page.

Sigma (1)

Kusto (1)

ListAttachedUserPolicies

2 detection rules reference this event. View event page.

Sigma (1)

Kusto (1)

ListGroups

3 detection rules reference this event. View event page.

Sigma (1)

Elastic (1)

Panther (1)

ListMFADevices

1 detection rules reference this event. View event page.

Elastic (1)

ListRoles

4 detection rules reference this event. View event page.

Sigma (2)

Elastic (1)

Kusto (1)

ListUserPolicies

1 detection rules reference this event. View event page.

Sigma (1)

ListUsers

3 detection rules reference this event. View event page.

Sigma (2)

Elastic (1)

PutRolePolicy

14 detection rules reference this event. View event page.

Elastic (2)

Kusto (11)

Panther (1)

PutUserPolicy

17 detection rules reference this event. View event page.

Sigma (1)

Elastic (2)

Kusto (11)

YARA-L (1)

Panther (2)

SetDefaultPolicyVersion

2 detection rules reference this event. View event page.

Elastic (1)

Splunk (1)

UpdateAccountPasswordPolicy

3 detection rules reference this event. View event page.

Splunk (1)

YARA-L (1)

Panther (1)

UpdateAssumeRolePolicy

2 detection rules reference this event. View event page.

Elastic (2)

UpdateLoginProfile

9 detection rules reference this event. View event page.

Sigma (1)

Elastic (2)

Splunk (2)

YARA-L (2)

Panther (2)

UpdateSAMLProvider

7 detection rules reference this event. View event page.

Sigma (1)

Elastic (1)

Splunk (2)

Kusto (1)

YARA-L (1)

Panther (1)

ChangePassword

1 detection rules reference this event. View event page.

Kusto (1)

CreateServiceLinkedRole

1 detection rules reference this event. View event page.

Panther (1)

CreateServiceSpecificCredential

1 detection rules reference this event. View event page.

Kusto (1)

DeleteAccessKey

1 detection rules reference this event. View event page.

Kusto (1)

DeleteGroupPolicy

2 detection rules reference this event. View event page.

Kusto (1)

Panther (1)

DeletePolicy

1 detection rules reference this event. View event page.

Elastic (1)

DeleteRole

1 detection rules reference this event. View event page.

Kusto (1)

DeleteRolePermissionsBoundary

1 detection rules reference this event. View event page.

Elastic (1)

DeleteRolePolicy

1 detection rules reference this event. View event page.

Panther (1)

DeleteServiceSpecificCredential

1 detection rules reference this event. View event page.

Kusto (1)

DeleteUser

1 detection rules reference this event. View event page.

Kusto (1)

DeleteUserPermissionsBoundary

1 detection rules reference this event. View event page.

Elastic (1)

DeleteUserPolicy

1 detection rules reference this event. View event page.

Panther (1)

DetachGroupPolicy

1 detection rules reference this event. View event page.

Panther (1)

DetachRolePolicy

1 detection rules reference this event. View event page.

Panther (1)

DetachUserPolicy

1 detection rules reference this event. View event page.

Panther (1)

GetAccountPasswordPolicy

2 detection rules reference this event. View event page.

Splunk (1)

Panther (1)

GetGroup

1 detection rules reference this event. View event page.

Panther (1)

GetGroupPolicy

1 detection rules reference this event. View event page.

Panther (1)

ListAttachedGroupPolicies

1 detection rules reference this event. View event page.

Panther (1)

ListGroupPolicies

1 detection rules reference this event. View event page.

Panther (1)

ListGroupsForUser

2 detection rules reference this event. View event page.

Kusto (1)

Panther (1)

PutGroupPolicy

13 detection rules reference this event. View event page.

Elastic (1)

Kusto (11)

Panther (1)

PutRolePermissionsBoundary

1 detection rules reference this event. View event page.

Elastic (1)

PutUserPermissionsBoundary

1 detection rules reference this event. View event page.

Elastic (1)

RemoveUserFromGroup

1 detection rules reference this event. View event page.

Kusto (1)

UploadServerCertificate

1 detection rules reference this event. View event page.

Kusto (1)