1type: trigger
2name: crowdsecurity/aws-cis-benchmark-nacl-change
3description: "Detect AWS NACL change"
4filter: |
5     evt.Meta.log_type == 'aws-cloudtrail' &&
6     (
7     evt.Meta.event_name == "CreateNetworkAcl" ||
8     evt.Meta.event_name == "CreateNetworkAclEntry" ||
9     evt.Meta.event_name == "DeleteNetworkAcl" ||
10     evt.Meta.event_name == "DeleteNetworkAclEntry" ||
11     evt.Meta.event_name == "ReplaceNetworkAclEntry" ||
12     evt.Meta.event_name == "ReplaceNetworkAclAssociation"
13     )
14labels:
15     confidence: 3
16     spoofable: 0
17     classification:
18          - attack.T1578
19     behavior: "cloud:audit"
20     label: "AWS NACL change"
21     service: aws
22     cti: false
23     remediation: false
24