AWS CloudTrail Important Change

Title: AWS CloudTrail Important Change
Status: test
Description:Detects disabling, deleting and updating of a Trail
References:
  -https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html
Author: vitaliy0x1
Date: 2020-01-21
modified:2022-10-09
Tags:

• -'attack.defense-impairment'
• -'attack.t1685.002'

Logsource:

• product: aws
• service: cloudtrail

Detection:
  selection_source:
    eventSource: 'cloudtrail.amazonaws.com'
    eventName:
      -'StopLogging'
      -'UpdateTrail'
      -'DeleteTrail'

  condition:selection_source
Falsepositives:
  -Valid change in a Trail
Level: medium