Isai 8b3d4f6691 [Rule Tuning] AWS RDS Instance/Cluster Deletion (#1916) ...

* add RDS instance deletion to aws rule

I've added to this rule to improve coverage. Currently we detect creation and stopping of RDS clusters and instances. But, we only detect for the deletion of clusters, not instances. This adds the deletion of RDS instances to the detection.

* Update rules/integrations/aws/impact_rds_instance_cluster_deletion.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit 9640ecb3fe)

2022-04-10 19:35:53 +00:00

..

collection_cloudtrail_logging_created.toml

[Rule tuning] Update rules based on docs review (#1663)

2022-01-28 19:43:39 +00:00

credential_access_aws_iam_assume_role_brute_force.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

credential_access_iam_user_addition_to_group.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

credential_access_root_console_failure_brute_force.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

credential_access_secretsmanager_getsecretvalue.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

defense_evasion_cloudtrail_logging_deleted.toml

[Rule tuning] Update rules based on docs review (#1663)

2022-01-28 19:43:39 +00:00

defense_evasion_cloudtrail_logging_suspended.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

defense_evasion_cloudwatch_alarm_deletion.toml

[Rule tuning] Update rules based on docs review (#1663)

2022-01-28 19:43:39 +00:00

defense_evasion_config_service_rule_deletion.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

defense_evasion_configuration_recorder_stopped.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

defense_evasion_ec2_flow_log_deletion.toml

[Rule tuning] Update rules based on docs review (#1663)

2022-01-28 19:43:39 +00:00

defense_evasion_ec2_network_acl_deletion.toml

[Rule tuning] Update rules based on docs review (#1663)

2022-01-28 19:43:39 +00:00

defense_evasion_elasticache_security_group_creation.toml

[Rule tuning] Update rules based on docs review (#1663)

2022-01-28 19:43:39 +00:00

defense_evasion_elasticache_security_group_modified_or_deleted.toml

[Rule tuning] Update rules based on docs review (#1663)

2022-01-28 19:43:39 +00:00

defense_evasion_guardduty_detector_deletion.toml

[Rule tuning] Update rules based on docs review (#1663)

2022-01-28 19:43:39 +00:00

defense_evasion_s3_bucket_configuration_deletion.toml

[Rule tuning] Update rules based on docs review (#1663)

2022-01-28 19:43:39 +00:00

defense_evasion_waf_acl_deletion.toml

[Rule tuning] Update rules based on docs review (#1663)

2022-01-28 19:43:39 +00:00

defense_evasion_waf_rule_or_rule_group_deletion.toml

[Rule Tuning] Adding event.provider to AWS WAF Rule or Rule Group Deletion (#1833)

2022-03-22 23:40:22 +00:00

exfiltration_ec2_full_network_packet_capture_detected.toml

[Rule tuning] Revise rule description and other text (#1398)

2021-08-03 13:07:47 -08:00

exfiltration_ec2_snapshot_change_activity.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

exfiltration_ec2_vm_export_failure.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

exfiltration_rds_snapshot_export.toml

[Bug] Tighten definitions validation patterns (#1396)

2021-10-26 10:26:20 -05:00

exfiltration_rds_snapshot_restored.toml

[Rule tuning] Update rules based on docs review (#1663)

2022-01-28 19:43:39 +00:00

impact_aws_eventbridge_rule_disabled_or_deleted.toml

[Rule tuning] Update rules based on docs review (#1663)

2022-01-28 19:43:39 +00:00

impact_cloudtrail_logging_updated.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

impact_cloudwatch_log_group_deletion.toml

[Rule tuning] Update rules based on docs review (#1663)

2022-01-28 19:43:39 +00:00

impact_cloudwatch_log_stream_deletion.toml

[Rule tuning] Update rules based on docs review (#1663)

2022-01-28 19:43:39 +00:00

impact_ec2_disable_ebs_encryption.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

impact_efs_filesystem_or_mount_deleted.toml

[Security Content] Update rules based on docs review (#1803)

2022-03-02 00:41:56 +00:00

impact_iam_deactivate_mfa_device.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

impact_iam_group_deletion.toml

[Rule tuning] Update rules based on docs review (#1663)

2022-01-28 19:43:39 +00:00

impact_rds_group_deletion.toml

[Rule tuning] Update rules based on docs review (#1663)

2022-01-28 19:43:39 +00:00

impact_rds_instance_cluster_deletion.toml

[Rule Tuning] AWS RDS Instance/Cluster Deletion (#1916)

2022-04-10 19:35:53 +00:00

impact_rds_instance_cluster_stoppage.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

initial_access_console_login_root.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

initial_access_password_recovery.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

initial_access_via_system_manager.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

ml_cloudtrail_error_message_spike.toml

[Security Content] Update rules based on docs review (#1803)

2022-03-02 00:41:56 +00:00

ml_cloudtrail_rare_error_code.toml

[Rule Tuning] Small update on rule descriptions (#1508)

2021-09-30 12:54:15 -08:00

ml_cloudtrail_rare_method_by_city.toml

[Rule Tuning] Small update on rule descriptions (#1508)

2021-09-30 12:54:15 -08:00

ml_cloudtrail_rare_method_by_country.toml

[Security Content] Update rules based on docs review (#1803)

2022-03-02 00:41:56 +00:00

ml_cloudtrail_rare_method_by_user.toml

[Rule Tuning] Small update on rule descriptions (#1508)

2021-09-30 12:54:15 -08:00

NOTICE.txt

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

persistence_ec2_network_acl_creation.toml

[Rule tuning] Update rules based on docs review (#1663)

2022-01-28 19:43:39 +00:00

persistence_ec2_security_group_configuration_change_detection.toml

[Rule Tuning] AWS Security Group Configuration Change Detection (#1915)

2022-04-07 18:49:49 +00:00

persistence_iam_group_creation.toml

[Rule tuning] Update rules based on docs review (#1663)

2022-01-28 19:43:39 +00:00

persistence_rds_cluster_creation.toml

[Rule tuning] Update rules based on docs review (#1663)

2022-01-28 19:43:39 +00:00

persistence_rds_group_creation.toml

[Rule tuning] Update rules based on docs review (#1663)

2022-01-28 19:43:39 +00:00

persistence_rds_instance_creation.toml

[Rule tuning] Update rules based on docs review (#1663)

2022-01-28 19:43:39 +00:00

persistence_route_53_domain_transfer_lock_disabled.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

persistence_route_53_domain_transferred_to_another_account.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

persistence_route_53_hosted_zone_associated_with_a_vpc.toml

[New Rule] AWS Route53 hosted zone associated with a VPC (#1365)

2021-10-15 15:59:33 -03:00

persistence_route_table_created.toml

[Rule tuning] Update rules based on docs review (#1663)

2022-01-28 19:43:39 +00:00

persistence_route_table_modified_or_deleted.toml

[Rule tuning] Update rules based on docs review (#1663)

2022-01-28 19:43:39 +00:00

privilege_escalation_aws_suspicious_saml_activity.toml

[Rule tuning] Update rules based on docs review (#1663)

2022-01-28 19:43:39 +00:00

privilege_escalation_root_login_without_mfa.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

privilege_escalation_sts_assumerole_usage.toml

[Rule tuning] Update rules based on docs review (#1663)

2022-01-28 19:43:39 +00:00

privilege_escalation_sts_getsessiontoken_abuse.toml

Add missing Integration field (#1537)

2021-10-26 12:05:12 -03:00

privilege_escalation_updateassumerolepolicy.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00