rules/cloud/aws/aws_cloudtrail_disable_logging.yml

title: AWS CloudTrail Important Change
id: 4db60cc0-36fb-42b7-9b58-a5b53019fb74
status: experimental
description: Detects disabling, deleting and updating of a Trail
author: vitaliy0x1
date: 2020/01/21
modified: 2021/08/09
references:
    - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html
logsource:
    product: aws
    service: cloudtrail
detection:
    selection_source:
        eventSource: cloudtrail.amazonaws.com
        eventName:
            - StopLogging
            - UpdateTrail
            - DeleteTrail
    condition: selection_source
falsepositives:
    - Valid change in a Trail
level: medium
tags:
    - attack.defense_evasion
    - attack.t1562.001
Minor Changes 2020-01-29 20:25:46 +01:00			`title: AWS CloudTrail Important Change`
added aws_cloudtrail_disable_logging.yml 2020-01-21 15:06:44 +02:00			`id: 4db60cc0-36fb-42b7-9b58-a5b53019fb74`
			`status: experimental`
Fixed my git issue 2020-09-13 22:03:04 -06:00			`description: Detects disabling, deleting and updating of a Trail`
added aws_cloudtrail_disable_logging.yml 2020-01-21 15:06:44 +02:00			`author: vitaliy0x1`
Minor Changes 2020-01-29 20:25:46 +01:00			`date: 2020/01/21`
$frack113$ split PR 1802 fix rules 2021-08-09 15:41:40 +02:00			`modified: 2021/08/09`
added aws_cloudtrail_disable_logging.yml 2020-01-21 15:06:44 +02:00			`references:`
Initial round of subtechnique updates 2020-06-16 14:46:08 -06:00			`- https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html`
added aws_cloudtrail_disable_logging.yml 2020-01-21 15:06:44 +02:00			`logsource:`
$frack113$ Add product aws 2021-11-14 09:56:59 +01:00			`product: aws`
Initial round of subtechnique updates 2020-06-16 14:46:08 -06:00			`service: cloudtrail`
added aws_cloudtrail_disable_logging.yml 2020-01-21 15:06:44 +02:00			`detection:`
Initial round of subtechnique updates 2020-06-16 14:46:08 -06:00			`selection_source:`
$frack113$ split PR 1802 fix rules 2021-08-09 15:41:40 +02:00			`eventSource: cloudtrail.amazonaws.com`
			`eventName:`
Initial round of subtechnique updates 2020-06-16 14:46:08 -06:00			`- StopLogging`
			`- UpdateTrail`
			`- DeleteTrail`
$frack113$ split PR 1802 fix rules 2021-08-09 15:41:40 +02:00			`condition: selection_source`
added aws_cloudtrail_disable_logging.yml 2020-01-21 15:06:44 +02:00			`falsepositives:`
			`- Valid change in a Trail`
Fixed my git issue 2020-09-13 22:03:04 -06:00			`level: medium`
added aws_cloudtrail_disable_logging.yml 2020-01-21 15:06:44 +02:00			`tags:`
Added ATT&CK tactic 2020-07-18 02:41:10 +01:00			`- attack.defense_evasion`
Initial round of subtechnique updates 2020-06-16 14:46:08 -06:00			`- attack.t1562.001`