valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 17:58:52 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Lowering level

Browse Source 
Lowering level to medium for events that can have a legitimate cause
This commit is contained in:
Florian Roth 2020-01-29 20:22:34 +01:00 committed by GitHub
parent 5aa75a90fd
commit f1ce6ba6ad
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
rules/cloud/aws_cloudtrail_disable_logging.yml
View File

@ -6,7 +6,7 @@ description: Detects disabling, deleting and updating of a Trail
references:
- https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html
logsource:
service: CloudTrail
service: cloudtrail
detection:
selection_source:
- eventSource: cloudtrail.amazonaws.com
@ -16,8 +16,8 @@ detection:
- UpdateTrail
- DeleteTrail
condition: selection_source AND events
level: high
level: medium
falsepositives:
- Valid change in a Trail
tags:
- attack.t1089
- attack.t1089