AWS CloudTrail configuration modified

Classification:

attack

Tactic:

Technique:

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Goal

Detect when an attacker is trying to evade defenses by modifying CloudTrail.

This rule detects if a user is modifying CloudTrail by monitoring the following CloudTrail API calls:

Review the @responseElements in the {{@evt.name}} event to determine the scope of the changes.
Determine if the user ARN ({{@userIdentity.arn}}) intended to make a CloudTrail modification.
If the user did not make the API call:
- Rotate the credentials.
- Investigate if the same credentials made other unauthorized API calls.