cscli scenarios install crowdsecurity/aws-cis-benchmark-cloudtrail-config-changeDetects AWS CloudTrail configuration changes based on cloudtrail logs (Section 4.5 of CIS AWS Foundation Benchmark 1.4.0 ).
1type: trigger2name: crowdsecurity/aws-cis-benchmark-cloudtrail-config-change3description: "Detect AWS CloudTrail configuration change"4filter: |5 evt.Meta.log_type == 'aws-cloudtrail' &&6 (7 evt.Meta.event_name == "CreateTrail" ||8 evt.Meta.event_name == "UpdateTrail" ||9 evt.Meta.event_name == "DeleteTrail" ||10 evt.Meta.event_name == "StartLogging" ||11 evt.Meta.event_name == "StopLogging"12 )13labels:14 confidence: 315 spoofable: 016 classification:17 - attack.T107018 behavior: "cloud:audit"19 label: "AWS CloudTrail indicator removal"20 service: aws21 cti: false22 remediation: false23