Difference between revisions of "Datadog SIEM Content Packs for Cloudtrail"
Jump to navigation
Jump to search
| Line 52: | Line 52: | ||
cloudtrail [[AWS IAM policy modified]] | cloudtrail [[AWS IAM policy modified]] | ||
cloudtrail [[AWS IAM Roles Anywhere trust anchor created]] | cloudtrail [[AWS IAM Roles Anywhere trust anchor created]] | ||
| − | cloudtrail [[AWS IAM User created with AdministratorAccess policy attached] | + | cloudtrail [[AWS IAM User created with AdministratorAccess policy attached]] |
cloudtrail [[AWS Java_Ghost security group creation attempt]] | cloudtrail [[AWS Java_Ghost security group creation attempt]] | ||
cloudtrail [[AWS Kinesis Firehose stream destination modified]] | cloudtrail [[AWS Kinesis Firehose stream destination modified]] | ||
| Line 62: | Line 62: | ||
cloudtrail [[AWS Lambda function modified by IAM user]] | cloudtrail [[AWS Lambda function modified by IAM user]] | ||
cloudtrail [[AWS Lambda function resource-based policy modified by IAM user]] | cloudtrail [[AWS Lambda function resource-based policy modified by IAM user]] | ||
| − | cloudtrail AWS Network Access Control List created or modified | + | cloudtrail [[AWS Network Access Control List created or modified]] |
| − | cloudtrail AWS Network Gateway created or modified | + | cloudtrail [[AWS Network Gateway created or modified]] |
| − | cloudtrail AWS principal added to multiple EKS clusters | + | cloudtrail [[AWS principal added to multiple EKS clusters]] |
| − | cloudtrail AWS principal assigned administrative privileges in an EKS cluster | + | cloudtrail [[AWS principal assigned administrative privileges in an EKS cluster]] |
| − | cloudtrail AWS principal granted access to a EKS cluster then removed | + | cloudtrail [[AWS principal granted access to a EKS cluster then removed]] |
| − | cloudtrail AWS RDS Cluster deleted | + | cloudtrail [[AWS RDS Cluster deleted]] |
| − | cloudtrail AWS root account activity | + | cloudtrail [[AWS root account activity]] |
| − | cloudtrail AWS Route 53 DNS query logging disabled | + | cloudtrail [[AWS Route 53 DNS query logging disabled]] |
| − | cloudtrail AWS Route 53 VPC disassociated from query logging configuration | + | cloudtrail [[AWS Route 53 VPC disassociated from query logging configuration]] |
| − | cloudtrail AWS Route Table created or modified | + | cloudtrail [[AWS Route Table created or modified]] |
| − | cloudtrail AWS S3 Bucket ACL made public | + | cloudtrail [[AWS S3 Bucket ACL made public]] |
| − | cloudtrail AWS S3 Public Access Block removed | + | cloudtrail [[AWS S3 Public Access Block removed]] |
| − | cloudtrail AWS security group created, modified or deleted | + | cloudtrail [[AWS security group created, modified or deleted]] |
| − | cloudtrail AWS Security Hub disabled | + | cloudtrail [[AWS Security Hub disabled]] |
| − | cloudtrail AWS SES add verified identity followed by the deletion of the identity | + | cloudtrail [[AWS SES add verified identity followed by the deletion of the identity]] |
| − | cloudtrail AWS SES discovery attempt by long term access key | + | cloudtrail [[AWS SES discovery attempt by long term access key]] |
| − | cloudtrail AWS SES email sending enabled in current AWS region | + | cloudtrail [[AWS SES email sending enabled in current AWS region]] |
| − | cloudtrail AWS VPC created or modified | + | cloudtrail [[AWS VPC created or modified]] |
| − | cloudtrail AWS VPC Flow Log deleted | + | cloudtrail [[AWS VPC Flow Log deleted]] |
cloudtrail AWS WAF traffic blocked by specific rule | cloudtrail AWS WAF traffic blocked by specific rule | ||
cloudtrail AWS WAF traffic blocked by specific rule on multiple IPs | cloudtrail AWS WAF traffic blocked by specific rule on multiple IPs | ||
Revision as of 08:18, 29 August 2024
cloudtrail A user received an anomalous number of AccessDenied errors cloudtrail Additional AWS regions enabled cloudtrail Amazon EC2 AMI exfiltration attempt by IAM user cloudtrail Amazon S3 bucket policy modified cloudtrail Amazon SES enumeration attempt by previously unseen user cloudtrail Amazon SES modification attempt cloudtrail Amazon SNS enumeration attempt by previously unseen user cloudtrail Amazon SNS enumeration in multiple regions using a long-term access key cloudtrail An AWS account attempted to leave the AWS Organization cloudtrail An AWS S3 bucket lifecycle expiration policy was set to disabled cloudtrail [[An AWS S3 bucket lifecycle policy expiration is set to < 90 days]] cloudtrail An AWS S3 bucket mfaDelete is disabled cloudtrail An EC2 instance attempted to enumerate S3 bucket cloudtrail Anomalous amount of access denied events for AWS EC2 Instance cloudtrail Anomalous amount of Autoscaling Group events cloudtrail Anomalous API Gateway API key reads by user cloudtrail Anomalous number of assumed roles from user cloudtrail Anomalous number of S3 buckets accessed cloudtrail Anomalous number of secrets retrieved from AWS Secrets Manager cloudtrail Anomalous S3 bucket activity from user ARN cloudtrail Attempt to create Xlarge EC2 instances in multiple AWS regions cloudtrail AWS access key creation by previously unseen identity cloudtrail AWS AMI Made Public cloudtrail AWS CloudTrail configuration modified cloudtrail AWS CloudTrail trail should have global service events enabled cloudtrail AWS CloudWatch log group deleted cloudtrail AWS CloudWatch rule disabled or deleted cloudtrail AWS Config modified cloudtrail AWS console login without MFA cloudtrail AWS ConsoleLogin with MFA triggered Impossible Travel scenario cloudtrail AWS ConsoleLogin without MFA triggered Impossible Travel scenario cloudtrail AWS Detective Graph deleted cloudtrail AWS Disable Cloudtrail with event selectors cloudtrail AWS EBS default encryption disabled cloudtrail AWS EBS Snapshot Made Public cloudtrail AWS EBS Snapshot possible exfiltration cloudtrail AWS EC2 new event for application cloudtrail AWS EC2 new event for EKS Node Group cloudtrail AWS EC2 subnet deleted cloudtrail AWS ECS cluster deleted cloudtrail AWS ECS CreateCluster API calls in multiple regions cloudtrail AWS EventBridge rule disabled or deleted cloudtrail AWS GuardDuty detector deleted cloudtrail AWS GuardDuty publishing destination deleted cloudtrail AWS GuardDuty threat intel set deleted cloudtrail AWS IAM activity by S3 browser utility cloudtrail AWS IAM activity from EC2 instance cloudtrail AWS IAM AdministratorAccess policy was applied to a group cloudtrail AWS IAM AdministratorAccess policy was applied to a role cloudtrail AWS IAM AdministratorAccess policy was applied to a user cloudtrail AWS IAM policy modified cloudtrail AWS IAM Roles Anywhere trust anchor created cloudtrail AWS IAM User created with AdministratorAccess policy attached cloudtrail AWS Java_Ghost security group creation attempt cloudtrail AWS Kinesis Firehose stream destination modified cloudtrail AWS KMS key deleted or scheduled for deletion cloudtrail AWS Lambda function modified by IAM user cloudtrail AWS Lambda function resource-based policy modified by IAM user cloudtrail AWS Network Access Control List created or modified cloudtrail AWS KMS key deleted or scheduled for deletion cloudtrail AWS Lambda function modified by IAM user cloudtrail AWS Lambda function resource-based policy modified by IAM user cloudtrail AWS Network Access Control List created or modified cloudtrail AWS Network Gateway created or modified cloudtrail AWS principal added to multiple EKS clusters cloudtrail AWS principal assigned administrative privileges in an EKS cluster cloudtrail AWS principal granted access to a EKS cluster then removed cloudtrail AWS RDS Cluster deleted cloudtrail AWS root account activity cloudtrail AWS Route 53 DNS query logging disabled cloudtrail AWS Route 53 VPC disassociated from query logging configuration cloudtrail AWS Route Table created or modified cloudtrail AWS S3 Bucket ACL made public cloudtrail AWS S3 Public Access Block removed cloudtrail AWS security group created, modified or deleted cloudtrail AWS Security Hub disabled cloudtrail AWS SES add verified identity followed by the deletion of the identity cloudtrail AWS SES discovery attempt by long term access key cloudtrail AWS SES email sending enabled in current AWS region cloudtrail AWS VPC created or modified cloudtrail AWS VPC Flow Log deleted cloudtrail AWS WAF traffic blocked by specific rule cloudtrail AWS WAF traffic blocked by specific rule on multiple IPs cloudtrail AWS WAF web access control list deleted cloudtrail AWS WAF web access control list modified cloudtrail CloudTrail log file validation should be enabled cloudtrail CloudTrail logs S3 bucket should not be public accessible cloudtrail CloudTrail logs should be encrypted at rest using KMS CMKs cloudtrail Cloudtrail SecretsManager secret retrieved from AWS CloudShell environment cloudtrail CloudTrail trails should be integrated with CloudWatch Logs cloudtrail Compromised AWS EC2 Instance cloudtrail Compromised AWS IAM User Access Key
cloudtrail Encrypted administrator password retrieved for Windows EC2 instance cloudtrail New Amazon EC2 Instance type cloudtrail New AWS account seen assuming a role into AWS account cloudtrail New Private Repository Container Image detected in AWS ECR cloudtrail New Public Repository Container Image detected in AWS ECR cloudtrail New user seen executing a command in an ECS task cloudtrail Object-level logging should be enabled for S3 bucket read events cloudtrail Possible AWS EC2 privilege escalation via the modification of user data cloudtrail Possible privilege escalation via AWS login profile manipulation cloudtrail Possible RDS Snapshot exfiltration cloudtrail Potential administrative port open to the world via AWS security group cloudtrail Potential brute force attack on AWS ConsoleLogin cloudtrail Potential database port open to the world via AWS security group cloudtrail S3 bucket access logging should be enabled on the CloudTrail S3 bucket cloudtrail S3 bucket write events should have object-level logging enabled cloudtrail Security group open to the world cloudtrail Temporary AWS security credentials generated for user cloudtrail The AWS managed policy AWSCompromisedKeyQuarantineV2 has been attached cloudtrail There should be at least one multi-region CloudTrail trail per AWS account cloudtrail Tor client IP address identified within AWS environment cloudtrail TruffleHog user agent observed in AWS cloudtrail Unfamiliar IAM user retrieved a decrypted AWS Systems Manager parameter cloudtrail Unfamiliar IAM user retrieved secret from AWS Secrets Manager cloudtrail Unfamiliar IAM user retrieved SSM parameter cloudtrail Unusual AWS enumeration event from EC2 instance cloudtrail User enumerated AWS Secrets Manager - Anomaly cloudtrail User enumerated AWS Systems Manager parameters - Anomaly cloudtrail User travel was impossible in AWS CloudTrail IAM log
See also
Advertising:
