blue-team-tools

aws_attached_malicious_lambda_layer.yml

Merge PR #4476 from @nasbench - re-organize cloud folder and other things

2023-10-12 13:32:24 +02:00

aws_cloudtrail_disable_logging.yml

Merge PR #4476 from @nasbench - re-organize cloud folder and other things

2023-10-12 13:32:24 +02:00

aws_config_disable_recording.yml

Merge PR #4681 from @nasbench - Add Missing Ref & Tags

2024-01-29 13:37:20 +01:00

aws_console_getsignintoken.yml

Merge PR #4734 from @clebron23 - Add new AWS rule related to GetSigninToken abuse

2024-02-26 22:27:22 +01:00

aws_delete_identity.yml

Merge PR #4533 from @nasbench - Promote experimental rules

2023-11-02 10:48:45 +01:00

aws_disable_bucket_versioning.yml

Merge PR #4523 from @sj-sec - Add New AWS Rule S3 Bucket Versioning Disable

2023-10-29 01:17:14 +02:00

aws_ec2_disable_encryption.yml

Merge PR #4476 from @nasbench - re-organize cloud folder and other things

2023-10-12 13:32:24 +02:00

aws_ec2_startup_script_change.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

aws_ec2_vm_export_failure.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

aws_ecs_task_definition_cred_endpoint_query.yml

Merge PR #4745 from @nasbench - Promote older rules status from experimental to test

2024-03-01 15:38:35 +01:00

aws_efs_fileshare_modified_or_deleted.yml

Merge PR #4476 from @nasbench - re-organize cloud folder and other things

2023-10-12 13:32:24 +02:00

aws_efs_fileshare_mount_modified_or_deleted.yml

Merge PR #4476 from @nasbench - re-organize cloud folder and other things

2023-10-12 13:32:24 +02:00

aws_eks_cluster_created_or_deleted.yml

Merge PR #4476 from @nasbench - re-organize cloud folder and other things

2023-10-12 13:32:24 +02:00

aws_elasticache_security_group_created.yml

Merge PR #4476 from @nasbench - re-organize cloud folder and other things

2023-10-12 13:32:24 +02:00

aws_elasticache_security_group_modified_or_deleted.yml

Merge PR #4476 from @nasbench - re-organize cloud folder and other things

2023-10-12 13:32:24 +02:00

aws_enum_buckets.yml

Merge PR #4905 from @kelnage - Fix error in field name

2024-07-11 00:19:55 +02:00

aws_guardduty_disruption.yml

Merge PR #4476 from @nasbench - re-organize cloud folder and other things

2023-10-12 13:32:24 +02:00

aws_iam_backdoor_users_keys.yml

Merge PR #4476 from @nasbench - re-organize cloud folder and other things

2023-10-12 13:32:24 +02:00

aws_iam_s3browser_loginprofile_creation.yml

Merge PR #4791 from @nasbench - Promote older rules status from experimental to test

2024-04-01 15:14:10 +02:00

aws_iam_s3browser_templated_s3_bucket_policy_creation.yml

Merge PR #4791 from @nasbench - Promote older rules status from experimental to test

2024-04-01 15:14:10 +02:00

aws_iam_s3browser_user_or_accesskey_creation.yml

Merge PR #4791 from @nasbench - Promote older rules status from experimental to test

2024-04-01 15:14:10 +02:00

aws_passed_role_to_glue_development_endpoint.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

aws_rds_change_master_password.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

aws_rds_public_db_restore.yml

Merge PR #4476 from @nasbench - re-organize cloud folder and other things

2023-10-12 13:32:24 +02:00

aws_root_account_usage.yml

Merge PR #4476 from @nasbench - re-organize cloud folder and other things

2023-10-12 13:32:24 +02:00

aws_route_53_domain_transferred_lock_disabled.yml

Merge PR #4476 from @nasbench - re-organize cloud folder and other things

2023-10-12 13:32:24 +02:00

aws_route_53_domain_transferred_to_another_account.yml

Merge PR #4476 from @nasbench - re-organize cloud folder and other things

2023-10-12 13:32:24 +02:00

aws_s3_data_management_tampering.yml

Merge PR #4476 from @nasbench - re-organize cloud folder and other things

2023-10-12 13:32:24 +02:00

aws_securityhub_finding_evasion.yml

Merge PR #4476 from @nasbench - re-organize cloud folder and other things

2023-10-12 13:32:24 +02:00

aws_snapshot_backup_exfiltration.yml

Merge PR #4476 from @nasbench - re-organize cloud folder and other things

2023-10-12 13:32:24 +02:00

aws_sso_idp_change.yml

Merge PR #4476 from @nasbench - re-organize cloud folder and other things

2023-10-12 13:32:24 +02:00

aws_sts_assumerole_misuse.yml

Merge PR #4476 from @nasbench - re-organize cloud folder and other things

2023-10-12 13:32:24 +02:00

aws_sts_getsessiontoken_misuse.yml

Merge PR #4476 from @nasbench - re-organize cloud folder and other things

2023-10-12 13:32:24 +02:00

aws_susp_saml_activity.yml

Merge PR #4476 from @nasbench - re-organize cloud folder and other things

2023-10-12 13:32:24 +02:00

aws_update_login_profile.yml

Merge PR #4836 from @jamesc-grafana - Update AWS Rule to use fieldref modifier instead of contains

2024-04-29 12:53:54 +02:00