Techniques
Sample rules
AWS CloudTrail Important Change
- source: sigma
- technicques:
- t1562
- t1562.001
Description
Detects disabling, deleting and updating of a Trail
Detection logic
condition: selection_source
selection_source:
eventName:
- StopLogging
- UpdateTrail
- DeleteTrail
eventSource: cloudtrail.amazonaws.com