SEKOIA.IO Rules low stable sigma

AWS CloudTrail EC2 Subnet Deleted

Detects when an attacker is destroying an EC2 subnet.

View Source

Detection Logic

selection:
  sekoiaio.intake.dialect_uuid: d3a813ac-f9b5-451c-a602-a5994544d9ed
  event.provider: ec2.amazonaws.com
  event.action: DeleteSubnet
condition: selection

Field Validations

Loading…

Comments (0)

Loading comments...