1type: trigger
2name: crowdsecurity/aws-cis-benchmark-security-group-change
3description: "Detect AWS Security Group change"
4filter: |
5     evt.Meta.log_type == 'aws-cloudtrail' &&
6     (
7     evt.Meta.event_name == "AuthorizeSecurityGroupIngress" ||
8     evt.Meta.event_name == "AuthorizeSecurityGroupEgress" ||
9     evt.Meta.event_name == "RevokeSecurityGroupIngress" ||
10     evt.Meta.event_name == "RevokeSecurityGroupEgress" ||
11     evt.Meta.event_name == "CreateSecurityGroup" ||
12     evt.Meta.event_name == "DeleteSecurityGroup"
13     )
14labels:
15     confidence: 3
16     spoofable: 0
17     classification:
18          - attack.T1578
19     behavior: "cloud:audit"
20     label: "AWS Security Group change"
21     service: aws
22     cti: false
23     remediation: false
24