Stefan Grimminck 47502e6701 add MITRE technique mapping

2021-10-20 14:29:57 +02:00

..

aws_attached_malicious_lambda_layer.yml

Use startswith for eventName selection

2021-10-05 17:52:52 +01:00

aws_cloudtrail_disable_logging.yml

move aws rules

2021-08-13 15:40:03 +02:00

aws_config_disable_recording.yml

move aws rules

2021-08-13 15:40:03 +02:00

aws_ec2_disable_encryption.yml

Update AWS CloudTrail rules

2021-08-20 13:43:00 +01:00

aws_ec2_download_userdata.yml

Update AWS CloudTrail rules

2021-08-20 13:43:00 +01:00

aws_ec2_startup_script_change.yml

move aws rules

2021-08-13 15:40:03 +02:00

aws_ec2_vm_export_failure.yml

Add filter3 back for vm export failure, without consolelogin

2021-08-20 15:42:49 +01:00

aws_efs_fileshare_modified_or_deleted.yml

Update aws_efs_fileshare_modified_or_deleted.yml

2021-08-15 22:52:41 -05:00

aws_efs_fileshare_mount_modified_or_deleted.yml

add MITRE technique mapping

2021-10-20 14:29:57 +02:00

aws_eks_cluster_created_or_deleted.yml

add MITRE technique mapping

2021-10-20 14:29:57 +02:00

aws_elasticache_security_group_created.yml

Forgot to add my username to some of the rules.

2021-08-20 02:09:31 +00:00

aws_elasticache_security_group_modified_or_deleted.yml

Forgot to add my username to some of the rules.

2021-08-20 02:09:31 +00:00

aws_enum_listing.yml

move aws rules

2021-08-13 15:40:03 +02:00

aws_guardduty_disruption.yml

move aws rules

2021-08-13 15:40:03 +02:00

aws_iam_backdoor_users_keys.yml

Update AWS CloudTrail rules

2021-08-20 13:43:00 +01:00

aws_lambda_function_created_or_invoked.yml

Update aws_lambda_function_created_or_invoked.yml

2021-10-14 12:10:29 -05:00

aws_macic_evasion.yml

move aws rules

2021-08-13 15:40:03 +02:00

aws_rds_change_master_password.yml

Update AWS CloudTrail rules

2021-08-20 13:43:00 +01:00

aws_rds_public_db_restore.yml

Update AWS CloudTrail rules

2021-08-20 13:43:00 +01:00

aws_root_account_usage.yml

fix condition operator case

2021-09-10 13:51:52 +02:00

aws_route_53_domain_transferred_lock_disabled.yml

Forgot to add my username to some of the rules.

2021-08-20 02:09:31 +00:00

aws_route_53_domain_transferred_to_another_account.yml

Forgot to add my username to some of the rules.

2021-08-20 02:09:31 +00:00

aws_s3_data_management_tampering.yml

Forgot to add my username to some of the rules.

2021-08-20 02:09:31 +00:00

aws_securityhub_finding_evasion.yml

move aws rules

2021-08-13 15:40:03 +02:00

aws_snapshot_backup_exfiltration.yml

Update AWS CloudTrail rules

2021-08-19 14:24:43 +01:00

aws_sts_assumerole_misuse.yml

Update AWS STS AssumeRole Misuse rule

2021-09-02 17:40:35 +01:00

aws_sts_getsessiontoken_misuse.yml

Forgot to add my username to some of the rules.

2021-08-20 02:09:31 +00:00

aws_suspicious_saml_activity.yml

Update AWS SAML and Lambda rules

2021-10-05 14:08:40 +01:00

aws_update_login_profile.yml

Unset date update

2021-09-07 16:36:59 +01:00

passed_role_to_glue_development_endpoint.yml

Update passed_role_to_glue_development_endpoint.yml

2021-10-14 12:10:48 -05:00