From e5edd03ff38d4eaa3efb363678f9fdb23c78df90 Mon Sep 17 00:00:00 2001
From: Austin Songer <austin@songer.pro>
Date: Sat, 24 Jul 2021 09:16:11 -0500
Subject: [PATCH] Create aws_elasticache_security_group_created.yml

---
 ...aws_elasticache_security_group_created.yml | 25 +++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 rules/cloud/aws_elasticache_security_group_created.yml

diff --git a/rules/cloud/aws_elasticache_security_group_created.yml b/rules/cloud/aws_elasticache_security_group_created.yml
new file mode 100644
index 000000000..494774ea3
--- /dev/null
+++ b/rules/cloud/aws_elasticache_security_group_created.yml
@@ -0,0 +1,25 @@
+title: AWS ElastiCache Security Group Created
+id: 4ae68615-866f-4304-b24b-ba048dfa5ca7 
+description: Detects when an ElastiCache security group has been created. 
+author: Austin Songer
+status: experimental
+date: 2021/07/24
+references:
+    - https://github.com/elastic/detection-rules/blob/598f3d7e0a63221c0703ad9a0ea7e22e7bc5961e/rules/integrations/aws/persistence_elasticache_security_group_creation.toml
+logsource:
+    service: cloudtrail
+detection:
+    selection_source:
+        - eventSource: elasticache.amazonaws.com
+    selection_eventname:
+        - eventName: "Create Cache Security Group"
+    condition: all of them
+level: low
+tags:
+    - attack.persistence
+    - attack.t1136
+	- attack.t1136.003
+falsepositives:
+- A ElastiCache security group may be created by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Security group creations from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
+
+