1type: trigger
2name: crowdsecurity/aws-cis-benchmark-ngw-change
3description: "Detect AWS Network Gateway change"
4filter: |
5     evt.Meta.log_type == 'aws-cloudtrail' &&
6     (
7     evt.Meta.event_name == "CreateCustomerGateway" ||
8     evt.Meta.event_name == "DeleteCustomerGateway" ||
9     evt.Meta.event_name == "AttachInternetGateway" ||
10     evt.Meta.event_name == "CreateInternetGateway" ||
11     evt.Meta.event_name == "DeleteInternetGateway" ||
12     evt.Meta.event_name == "DetachInternetGateway"
13     )
14labels:
15     confidence: 3
16     spoofable: 0
17     classification:
18          - attack.T1578
19     behavior: "cloud:audit"
20     label: "AWS Network Gateway change"
21     service: aws
22     cti: false
23     remediation: false
24