BlueTeamOps 05135ec828 Further improved several AWS rules (#3827) ...

Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>

2022-12-28 19:46:36 +01:00

..

aws_attached_malicious_lambda_layer.yml

Order yaml field

2022-10-25 07:34:10 +02:00

aws_cloudtrail_disable_logging.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

aws_config_disable_recording.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

aws_delete_identity.yml

Further improved several AWS rules (#3827)

2022-12-28 19:46:36 +01:00

aws_ec2_disable_encryption.yml

Order yaml field

2022-10-25 07:34:10 +02:00

aws_ec2_download_userdata.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

aws_ec2_startup_script_change.yml

Order yaml field

2022-10-25 07:34:10 +02:00

aws_ec2_vm_export_failure.yml

Order yaml field

2022-10-25 07:34:10 +02:00

aws_ecs_task_definition_backdoor.yml

Order yaml field

2022-10-25 07:34:10 +02:00

aws_efs_fileshare_modified_or_deleted.yml

Order yaml field

2022-10-25 07:34:10 +02:00

aws_efs_fileshare_mount_modified_or_deleted.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

aws_eks_cluster_created_or_deleted.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

aws_elasticache_security_group_created.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

aws_elasticache_security_group_modified_or_deleted.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

aws_enum_backup.yml

Further improved several AWS rules (#3827)

2022-12-28 19:46:36 +01:00

aws_enum_listing.yml

Order yaml field

2022-10-25 07:34:10 +02:00

aws_enum_network.yml

Further improved several AWS rules (#3827)

2022-12-28 19:46:36 +01:00

aws_enum_storage.yml

Further improved several AWS rules (#3827)

2022-12-28 19:46:36 +01:00

aws_guardduty_disruption.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

aws_iam_backdoor_users_keys.yml

Order yaml field

2022-10-25 07:34:10 +02:00

aws_lambda_function_created_or_invoked.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

aws_macic_evasion.yml

Order yaml field

2022-10-25 07:34:10 +02:00

aws_passed_role_to_glue_development_endpoint.yml

Refractor (#3794)

2022-12-18 21:00:14 +01:00

aws_rds_change_master_password.yml

Order yaml field

2022-10-25 07:34:10 +02:00

aws_rds_public_db_restore.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

aws_root_account_usage.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

aws_route_53_domain_transferred_lock_disabled.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

aws_route_53_domain_transferred_to_another_account.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

aws_s3_data_management_tampering.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

aws_securityhub_finding_evasion.yml

Order yaml field

2022-10-25 07:34:10 +02:00

aws_ses_messaging_enabled.yml

Further improved several AWS rules (#3827)

2022-12-28 19:46:36 +01:00

aws_snapshot_backup_exfiltration.yml

Order yaml field

2022-10-25 07:34:10 +02:00

aws_sts_assumerole_misuse.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

aws_sts_getsessiontoken_misuse.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

aws_susp_saml_activity.yml

Refractor (#3794)

2022-12-18 21:00:14 +01:00

aws_update_login_profile.yml

Order yaml field

2022-10-25 07:34:10 +02:00