blue-team-tools

aws_cloudtrail_disable_logging.yml

Merge PR #5579 from @Liran017 - Update MITRE ATT&CK tags for multiple rules

2025-08-14 14:08:21 +02:00

aws_cloudtrail_imds_malicious_usage.yml

Merge PR #5448 from @nasbench - Promote older rules status from experimental to test

2025-06-02 13:29:48 +02:00

aws_cloudtrail_new_acl_entries.yml

Merge PR #5579 from @Liran017 - Update MITRE ATT&CK tags for multiple rules

2025-08-14 14:08:21 +02:00

aws_cloudtrail_new_route_added.yml

Merge PR #5579 from @Liran017 - Update MITRE ATT&CK tags for multiple rules

2025-08-14 14:08:21 +02:00

aws_cloudtrail_security_group_change_ingress_egress.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_cloudtrail_security_group_change_loadbalancer.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_cloudtrail_security_group_change_rds.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_cloudtrail_ssm_malicious_usage.yml

Merge PR #5452 from @david-syk - Update the MITRE ATT&CK tags for multiple rules

2025-06-04 14:39:25 +02:00

aws_config_disable_recording.yml

Merge PR #5579 from @Liran017 - Update MITRE ATT&CK tags for multiple rules

2025-08-14 14:08:21 +02:00

aws_console_getsignintoken.yml

Merge PR #5149 from @nasbench - Promote older rules status from experimental to test

2025-01-06 15:36:19 +01:00

aws_delete_identity.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_delete_saml_provider.yml

Merge PR #5452 from @david-syk - Update the MITRE ATT&CK tags for multiple rules

2025-06-04 14:39:25 +02:00

aws_disable_bucket_versioning.yml

Merge PR #4991 from @nasbench - Promote older rules status from experimental to test

2024-09-02 10:01:36 +02:00

aws_ec2_disable_encryption.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_ec2_import_key_pair_activity.yml

Merge PR #5023 from @saakovv - Add AWS Key Pair Import Activity

2024-12-19 18:35:28 +01:00

aws_ec2_startup_script_change.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_ec2_vm_export_failure.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_ecs_task_definition_cred_endpoint_query.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_efs_fileshare_modified_or_deleted.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_efs_fileshare_mount_modified_or_deleted.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_eks_cluster_created_or_deleted.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_elasticache_security_group_created.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_elasticache_security_group_modified_or_deleted.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_enum_buckets.yml

Merge PR #5579 from @Liran017 - Update MITRE ATT&CK tags for multiple rules

2025-08-14 14:08:21 +02:00

aws_guardduty_disruption.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_iam_backdoor_users_keys.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_iam_s3browser_loginprofile_creation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_iam_s3browser_templated_s3_bucket_policy_creation.yml

Merge PR #5451 from @frack113 - chore: cleanup metadata

2025-06-04 13:33:36 +02:00

aws_iam_s3browser_user_or_accesskey_creation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_lambda_function_url.yml

Merge PR #5016 from @saakovv - Add New AWS Lambda Function URL Configuration Created

2024-12-19 20:30:58 +01:00

aws_new_lambda_layer_attached.yml

Merge PR #5236 from @nickatrecon - Update AWS New Lambda Layer Attached

2025-04-07 11:07:50 +02:00

aws_passed_role_to_glue_development_endpoint.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_rds_change_master_password.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_rds_dbcluster_actions.yml

Merge PR #5017 from @saakovv - Add Modification or Deletion of an AWS RDS Cluster

2024-12-07 00:19:18 +01:00

aws_rds_public_db_restore.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_root_account_usage.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_route_53_domain_transferred_lock_disabled.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_route_53_domain_transferred_to_another_account.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_s3_data_management_tampering.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_securityhub_finding_evasion.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_snapshot_backup_exfiltration.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_sso_idp_change.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_sts_assumerole_misuse.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_sts_getsessiontoken_misuse.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_susp_saml_activity.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

aws_update_login_profile.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00