cscli scenarios install crowdsecurity/aws-cis-benchmark-config-config-changeDetects AWS Config configuration changes based on cloudtrail logs (Section 4.9 of CIS AWS Foundation Benchmark 1.4.0 ).
1type: trigger2name: crowdsecurity/aws-cis-benchmark-config-config-change3description: "Detect AWS Config configuration change"4filter: |5 evt.Meta.log_type == 'aws-cloudtrail' &&6 evt.Unmarshaled.cloudtrail.eventSource == "config.amazonaws.com" &&7 (8 evt.Meta.event_name == "StopConfigurationRecorder" ||9 evt.Meta.event_name == "DeleteDeliveryChannel" ||10 evt.Meta.event_name == "PutDeliveryChannel" ||11 evt.Meta.event_name == "PutConfigurationRecorder"12 )13labels:14 confidence: 315 spoofable: 016 classification:17 - attack.T107018 behavior: "cloud:audit"19 label: "AWS Config indicator removal"20 service: aws21 cti: false22 remediation: false23