{"id":"4db60cc0-36fb-42b7-9b58-a5b53019fb74","title":"AWS CloudTrail Important Change","description":"Detects disabling, deleting and updating of a Trail","author":"vitaliy0x1","status":"test","level":"medium","date":"2020-01-21","modified":"2022-10-09","tags":["attack.defense-impairment","attack.t1685.002"],"technique_ids":["T1685.002"],"logsource":{"product":"aws","service":"cloudtrail"},"falsepositives":["Valid change in a Trail"],"references":["https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html"],"source_path":"rules/cloud/aws/cloudtrail/aws_cloudtrail_disable_logging.yml","source_sha256":"3eb82f86bbab060a5d8c971e30580894a3f9ef016438dd42f7aca68c2ee2b6b5","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_cloudtrail_disable_logging.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: AWS CloudTrail Important Change\nid: 4db60cc0-36fb-42b7-9b58-a5b53019fb74\nstatus: test\ndescription: Detects disabling, deleting and updating of a Trail\nreferences:\n    - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html\nauthor: vitaliy0x1\ndate: 2020-01-21\nmodified: 2022-10-09\ntags:\n    - attack.defense-impairment\n    - attack.t1685.002\nlogsource:\n    product: aws\n    service: cloudtrail\ndetection:\n    selection_source:\n        eventSource: cloudtrail.amazonaws.com\n        eventName:\n            - StopLogging\n            - UpdateTrail\n            - DeleteTrail\n    condition: selection_source\nfalsepositives:\n    - Valid change in a Trail\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685.002","id":"T1685.002","name":"Disable or Modify Cloud Log","page":"techniques/enterprise/T1685.002/"}],"data_path":"data/detection-rules/4db60cc0-36fb-42b7-9b58-a5b53019fb74.json","kind":"sigma"}