cscli scenarios install crowdsecurity/aws-cis-benchmark-nacl-changeDetects AWS NACL changes based on cloudtrail logs (Section 4.11 of CIS AWS Foundation Benchmark 1.4.0 ).
1type: trigger2name: crowdsecurity/aws-cis-benchmark-nacl-change3description: "Detect AWS NACL change"4filter: |5 evt.Meta.log_type == 'aws-cloudtrail' &&6 (7 evt.Meta.event_name == "CreateNetworkAcl" ||8 evt.Meta.event_name == "CreateNetworkAclEntry" ||9 evt.Meta.event_name == "DeleteNetworkAcl" ||10 evt.Meta.event_name == "DeleteNetworkAclEntry" ||11 evt.Meta.event_name == "ReplaceNetworkAclEntry" ||12 evt.Meta.event_name == "ReplaceNetworkAclAssociation"13 )14labels:15 confidence: 316 spoofable: 017 classification:18 - attack.T157819 behavior: "cloud:audit"20 label: "AWS NACL change"21 service: aws22 cti: false23 remediation: false24