security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
0d2ddb4a9bdcc94a36dc646cb4c2f2ff14d83bcd
blue-team-tools/rules/cloud/aws
T
History
Nasreddine Bencherchali a1b2e0ee81 Merge pull request #3781 from blueteam0ps/aws_det 
Multiple AWS detection rules
2022-12-23 12:41:15 +01:00
..
aws_attached_malicious_lambda_layer.yml
Order yaml field
2022-10-25 07:34:10 +02:00
aws_cloudtrail_disable_logging.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
aws_config_disable_recording.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
aws_delete_identity.yml
fix: enhance metadata information
2022-12-23 11:01:57 +01:00
aws_ec2_disable_encryption.yml
Order yaml field
2022-10-25 07:34:10 +02:00
aws_ec2_download_userdata.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
aws_ec2_startup_script_change.yml
Order yaml field
2022-10-25 07:34:10 +02:00
aws_ec2_vm_export_failure.yml
Order yaml field
2022-10-25 07:34:10 +02:00
aws_ecs_task_definition_backdoor.yml
Order yaml field
2022-10-25 07:34:10 +02:00
aws_efs_fileshare_modified_or_deleted.yml
Order yaml field
2022-10-25 07:34:10 +02:00
aws_efs_fileshare_mount_modified_or_deleted.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
aws_eks_cluster_created_or_deleted.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
aws_elasticache_security_group_created.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
aws_elasticache_security_group_modified_or_deleted.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
aws_enum_listing.yml
Order yaml field
2022-10-25 07:34:10 +02:00
aws_enum_logging.yml
Add count condition
2022-12-23 12:32:05 +01:00
aws_enum_network.yml
Add count condition
2022-12-23 12:32:05 +01:00
aws_enum_storage.yml
Add count condition
2022-12-23 12:32:05 +01:00
aws_guardduty_disruption.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
aws_iam_backdoor_users_keys.yml
Order yaml field
2022-10-25 07:34:10 +02:00
aws_lambda_function_created_or_invoked.yml
Order yaml field
2022-10-25 07:34:10 +02:00
aws_macic_evasion.yml
Order yaml field
2022-10-25 07:34:10 +02:00
aws_passed_role_to_glue_development_endpoint.yml
Refractor (#3794)
2022-12-18 21:00:14 +01:00
aws_rds_change_master_password.yml
Order yaml field
2022-10-25 07:34:10 +02:00
aws_rds_public_db_restore.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
aws_root_account_usage.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
aws_route_53_domain_transferred_lock_disabled.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
aws_route_53_domain_transferred_to_another_account.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
aws_s3_data_management_tampering.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
aws_securityhub_finding_evasion.yml
Order yaml field
2022-10-25 07:34:10 +02:00
aws_ses_messaging_enabled.yml
fix: enhance metadata information
2022-12-23 11:01:57 +01:00
aws_snapshot_backup_exfiltration.yml
Order yaml field
2022-10-25 07:34:10 +02:00
aws_sts_assumerole_misuse.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
aws_sts_getsessiontoken_misuse.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
aws_susp_saml_activity.yml
Refractor (#3794)
2022-12-18 21:00:14 +01:00
aws_update_login_profile.yml
Order yaml field
2022-10-25 07:34:10 +02:00