Nasreddine Bencherchali cf3cbf8089 Merge PR #5799 from @nasbench - Update logic to use errorCode instead for better mapping and accuracy ...

update: Potential Malicious Usage of CloudTrail System Manager - Update logic to use errorCode instead for better mapping and accuracy

2025-12-09 10:17:50 +01:00

..

aws_cloudtrail_bucket_deleted.yml

Merge PR #5021 from @saakovv - New rules for AWS

2025-10-22 14:36:42 +02:00

aws_cloudtrail_console_login_failed_authentication.yml

Merge PR #5021 from @saakovv - New rules for AWS

2025-10-22 14:36:42 +02:00

aws_cloudtrail_console_login_success_without_mfa.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

aws_cloudtrail_disable_logging.yml

Merge PR #5579 from @Liran017 - Update MITRE ATT&CK tags for multiple rules

2025-08-14 14:08:21 +02:00

aws_cloudtrail_guardduty_detector_deleted_or_updated.yml

Merge PR #5536 from @suKTech24 - Add AWS GuardDuty Detector Deleted Or Updated

2025-11-28 10:33:03 +01:00

aws_cloudtrail_imds_malicious_usage.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

aws_cloudtrail_new_acl_entries.yml

Merge PR #5579 from @Liran017 - Update MITRE ATT&CK tags for multiple rules

2025-08-14 14:08:21 +02:00

aws_cloudtrail_new_route_added.yml

Merge PR #5579 from @Liran017 - Update MITRE ATT&CK tags for multiple rules

2025-08-14 14:08:21 +02:00

aws_cloudtrail_pua_trufflehog.yml

Merge PR #5711 from @swachchhanda000 - Add PUA - AWS TruffleHog Execution

2025-10-29 11:40:20 +01:00

aws_cloudtrail_region_enabled.yml

Merge PR #5021 from @saakovv - New rules for AWS

2025-10-22 14:36:42 +02:00

aws_cloudtrail_security_group_change_ingress_egress.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_cloudtrail_security_group_change_loadbalancer.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_cloudtrail_security_group_change_rds.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_cloudtrail_ssm_malicious_usage.yml

Merge PR #5799 from @nasbench - Update logic to use errorCode instead for better mapping and accuracy

2025-12-09 10:17:50 +01:00

aws_cloudtrail_vpc_flow_logs_deleted.yml

Merge PR #5021 from @saakovv - New rules for AWS

2025-10-22 14:36:42 +02:00

aws_config_disable_recording.yml

Merge PR #5579 from @Liran017 - Update MITRE ATT&CK tags for multiple rules

2025-08-14 14:08:21 +02:00

aws_console_getsignintoken.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

aws_delete_identity.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_delete_saml_provider.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

aws_disable_bucket_versioning.yml

Merge PR #4991 from @nasbench - Promote older rules status from experimental to test

2024-09-02 10:01:36 +02:00

aws_ec2_disable_encryption.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_ec2_import_key_pair_activity.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

aws_ec2_startup_script_change.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_ec2_vm_export_failure.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_ecs_task_definition_cred_endpoint_query.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_efs_fileshare_modified_or_deleted.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_efs_fileshare_mount_modified_or_deleted.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_eks_cluster_created_or_deleted.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_elasticache_security_group_created.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_elasticache_security_group_modified_or_deleted.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_enum_buckets.yml

Merge PR #5579 from @Liran017 - Update MITRE ATT&CK tags for multiple rules

2025-08-14 14:08:21 +02:00

aws_guardduty_disruption.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_iam_backdoor_users_keys.yml

Merge PR #5769 from @nasbench - fix keywords rule and remove the fields field

2025-11-24 09:54:29 +01:00

aws_iam_s3browser_loginprofile_creation.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

aws_iam_s3browser_templated_s3_bucket_policy_creation.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

aws_iam_s3browser_user_or_accesskey_creation.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

aws_kms_import_key_material.yml

Merge PR #5193 from @toopricey - Add AWS KMS Imported Key Material Usage

2025-10-28 22:13:17 +01:00

aws_lambda_function_url.yml

Merge PR #5016 from @saakovv - Add New AWS Lambda Function URL Configuration Created

2024-12-19 20:30:58 +01:00

aws_new_lambda_layer_attached.yml

Merge PR #5236 from @nickatrecon - Update AWS New Lambda Layer Attached

2025-04-07 11:07:50 +02:00

aws_passed_role_to_glue_development_endpoint.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_rds_change_master_password.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_rds_dbcluster_actions.yml

Merge PR #5017 from @saakovv - Add Modification or Deletion of an AWS RDS Cluster

2024-12-07 00:19:18 +01:00

aws_rds_public_db_restore.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_root_account_usage.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

aws_route_53_domain_transferred_lock_disabled.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

aws_route_53_domain_transferred_to_another_account.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

aws_s3_data_management_tampering.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_securityhub_finding_evasion.yml

Merge PR #5769 from @nasbench - fix keywords rule and remove the fields field

2025-11-24 09:54:29 +01:00

aws_snapshot_backup_exfiltration.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_sso_idp_change.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

aws_sts_assumerole_misuse.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

aws_sts_getcalleridentity_trufflehog.yml

Merge PR #5688 from @adanalvarez - AWS STS GetCallerIdentity Enumeration Via TruffleHog

2025-10-23 13:48:06 +02:00

aws_sts_getsessiontoken_misuse.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

aws_susp_saml_activity.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

aws_update_login_profile.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00