{"id":"a607e1fe-74bf-4440-a3ec-b059b9103157","title":"AWS SecurityHub Findings Evasion","description":"Detects the modification of the findings on SecurityHub.","author":"Sittikorn S","status":"stable","level":"high","date":"2021-06-28","modified":"","tags":["attack.defense-impairment","attack.t1685"],"technique_ids":["T1685"],"logsource":{"product":"aws","service":"cloudtrail"},"falsepositives":["System or Network administrator behaviors","DEV, UAT, SAT environment. You should apply this rule with PROD environment only."],"references":["https://docs.aws.amazon.com/cli/latest/reference/securityhub/"],"source_path":"rules/cloud/aws/cloudtrail/aws_securityhub_finding_evasion.yml","source_sha256":"865044229606ad4a1bc676f90a7c5edb0de04a5b9f518b69888648aee3480e91","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_securityhub_finding_evasion.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: AWS SecurityHub Findings Evasion\nid: a607e1fe-74bf-4440-a3ec-b059b9103157\nstatus: stable\ndescription: Detects the modification of the findings on SecurityHub.\nreferences:\n    - https://docs.aws.amazon.com/cli/latest/reference/securityhub/\nauthor: Sittikorn S\ndate: 2021-06-28\ntags:\n    - attack.defense-impairment\n    - attack.t1685\nlogsource:\n    product: aws\n    service: cloudtrail\ndetection:\n    selection:\n        eventSource: securityhub.amazonaws.com\n        eventName:\n            - 'BatchUpdateFindings'\n            - 'DeleteInsight'\n            - 'UpdateFindings'\n            - 'UpdateInsight'\n    condition: selection\nfalsepositives:\n    - System or Network administrator behaviors\n    - DEV, UAT, SAT environment. You should apply this rule with PROD environment only.\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/a607e1fe-74bf-4440-a3ec-b059b9103157.json","kind":"sigma"}