valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 17:58:52 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update aws_elasticache_security_group_created.yml

Browse Source
This commit is contained in:
Austin Songer 2021-07-24 09:34:08 -05:00 committed by GitHub
parent e5edd03ff3
commit 5d3b687ce4
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
rules/cloud/aws_elasticache_security_group_created.yml
View File

@ -18,7 +18,7 @@ level: low
tags:
- attack.persistence
- attack.t1136
- attack.t1136.003
- attack.t1136.003
falsepositives:
- A ElastiCache security group may be created by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Security group creations from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.