Detection rules › By catalog entry

AWS-logs

Catalog entry	Rules
DeleteLogGroup	6
DeleteLogStream	2

DeleteLogGroup

6 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS CloudWatch Log Group Deletion severity medium T1485,T1685,T1685.002

Splunk (2)

ASL AWS Defense Evasion Delete CloudWatch Log Group severity medium T1685,T1685.002
AWS Defense Evasion Delete CloudWatch Log Group severity medium T1685,T1685.002

Kusto (2)

AWSCloudTrail - Failed Attempts to Change AWS CloudTrail Logs severity low T1685,T1685.002
AWSCloudTrail - Successful Tampering with AWS CloudTrail Logs severity high T1685,T1685.002

YARA-L (1)

AWS Delete CloudWatch Log Group severity high T1685,T1685.002

DeleteLogStream

2 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS CloudWatch Log Stream Deletion severity medium T1485,T1685,T1685.002

Splunk (1)

ASL AWS Defense Evasion Impair Security Services T1685,T1685.002

Back to all AWS-logs catalog entries