Detection rules › By catalog entry

AWS-organizations

Catalog entry	Rules
DescribeOrganization	1
DescribeResourcePolicy	1
LeaveOrganization	3
ListAccounts	1
ListAccountsForParent	1
ListAWSServiceAccessForOrganization	1
ListDelegatedAdministrators	1
ListDelegatedServicesForAccount	1
ListOrganizationalUnitsForParent	1
ListPolicies	1
ListRoots	1
RemoveAccountFromOrganization	1
CloseAccount	1
RegisterDelegatedAdministrator	1

DescribeOrganization

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS Account Discovery By Rare User severity low T1087,T1087.004,T1580

DescribeResourcePolicy

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS Account Discovery By Rare User severity low T1087,T1087.004,T1580

LeaveOrganization

3 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS Attempt to Leave Organization severity medium T1531,T1685

YARA-L (1)

AWS Account Leaving Or Removed From The Organization severity low T1685

Panther (1)

AWS CloudTrail Attempt To Leave Org severity informational T1666,T1685.002

ListAccounts

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS Account Discovery By Rare User severity low T1087,T1087.004,T1580

ListAccountsForParent

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS Account Discovery By Rare User severity low T1087,T1087.004,T1580

ListAWSServiceAccessForOrganization

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS Account Discovery By Rare User severity low T1087,T1087.004,T1580

ListDelegatedAdministrators

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS Account Discovery By Rare User severity low T1087,T1087.004,T1580

ListDelegatedServicesForAccount

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS Account Discovery By Rare User severity low T1087,T1087.004,T1580

ListOrganizationalUnitsForParent

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS Account Discovery By Rare User severity low T1087,T1087.004,T1580

ListPolicies

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS Account Discovery By Rare User severity low T1087,T1087.004,T1580

ListRoots

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS Account Discovery By Rare User severity low T1087,T1087.004,T1580

RemoveAccountFromOrganization

1 detection rules reference this catalog entry. View catalog entry.

YARA-L (1)

AWS Account Leaving Or Removed From The Organization severity low T1685

CloseAccount

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS Account Closed severity medium T1485,T1531

RegisterDelegatedAdministrator

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS Organizations Delegated Administrator Registered severity medium T1098,T1098.003,T1484

Back to all AWS-organizations catalog entries