Sagan unknown stable other

[AWS-CLOUDTRAIL] AWS Cloudtrail event detected (DeleteTrail)

[AWS-CLOUDTRAIL] AWS Cloudtrail event detected (DeleteTrail)

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[AWS-CLOUDTRAIL] AWS Cloudtrail event detected (DeleteTrail) "; program:cloudtrail.amazonaws.com; json_content:".eventName","DeleteTrail"; parse_src_ip: 1; content: !"
| 22
| mfaAuthenticated
| 22 3a 20 22
| true
| 22
| "; classtype:user-activity; reference:url,docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_Operations.html; sid:5008315; rev:2; metadata: mitre_technique_id T1005, mitre_technique_id T1078, mitre_technique_id T1530;)

Field Validations

Loading…

Comments (0)

Loading comments...