Detection rules › By event

AWS-organizations

Event	Rules
DescribeOrganization	1
DescribeResourcePolicy	1
LeaveOrganization	3
ListAccounts	1
ListAccountsForParent	1
ListAWSServiceAccessForOrganization	1
ListDelegatedAdministrators	1
ListDelegatedServicesForAccount	1
ListOrganizationalUnitsForParent	1
ListPolicies	1
ListRoots	1
RemoveAccountFromOrganization	1
CloseAccount	1

DescribeOrganization

1 detection rules reference this event. View event page.

Elastic (1)

AWS Account Discovery By Rare User severity low T1087, T1087.004, T1580

DescribeResourcePolicy

1 detection rules reference this event. View event page.

Elastic (1)

AWS Account Discovery By Rare User severity low T1087, T1087.004, T1580

LeaveOrganization

3 detection rules reference this event. View event page.

Elastic (1)

AWS Attempt to Leave Organization severity medium T1531, T1685

YARA-L (1)

AWS Account Leaving Or Removed From The Organization severity low T1685

Panther (1)

AWS CloudTrail Attempt To Leave Org severity informational T1666, T1685.002

ListAccounts

1 detection rules reference this event. View event page.

Elastic (1)

AWS Account Discovery By Rare User severity low T1087, T1087.004, T1580

ListAccountsForParent

1 detection rules reference this event. View event page.

Elastic (1)

AWS Account Discovery By Rare User severity low T1087, T1087.004, T1580

ListAWSServiceAccessForOrganization

1 detection rules reference this event. View event page.

Elastic (1)

AWS Account Discovery By Rare User severity low T1087, T1087.004, T1580

ListDelegatedAdministrators

1 detection rules reference this event. View event page.

Elastic (1)

AWS Account Discovery By Rare User severity low T1087, T1087.004, T1580

ListDelegatedServicesForAccount

1 detection rules reference this event. View event page.

Elastic (1)

AWS Account Discovery By Rare User severity low T1087, T1087.004, T1580

ListOrganizationalUnitsForParent

1 detection rules reference this event. View event page.

Elastic (1)

AWS Account Discovery By Rare User severity low T1087, T1087.004, T1580

ListPolicies

1 detection rules reference this event. View event page.

Elastic (1)

AWS Account Discovery By Rare User severity low T1087, T1087.004, T1580

ListRoots

1 detection rules reference this event. View event page.

Elastic (1)

AWS Account Discovery By Rare User severity low T1087, T1087.004, T1580

RemoveAccountFromOrganization

1 detection rules reference this event. View event page.

YARA-L (1)

AWS Account Leaving Or Removed From The Organization severity low T1685

CloseAccount

1 detection rules reference this event. View event page.

Elastic (1)

AWS Account Closed severity medium T1485, T1531