SEKOIA.IO Rules medium stable sigma

AWS CloudTrail IAM Password Policy Updated

Detects an update to the password policy. This could be an attempt to lower accounts security level.

View Source

Detection Logic

selection:
  sekoiaio.intake.dialect_uuid: d3a813ac-f9b5-451c-a602-a5994544d9ed
  event.provider: iam.amazonaws.com
  event.action: UpdateAccountPasswordPolicy
condition: selection

Field Validations

Loading…

Comments (0)

Loading comments...