Hub configuration

Name: AWS route table change
Author: crowdsecurity

More info

AWS route table change Detection Scenario by crowdsecurity | CrowdSec Hub

« AWS route table change »
v0.3 by crowdsecurity / aws-cis-benchmark-route-table-change
Attack scenarioawsNot spoofableHigh confidence

Detect AWS route table change

Installation

cscli scenarios install crowdsecurity/aws-cis-benchmark-route-table-change

Description

Detects AWS Route Table changes based on cloudtrail logs (Section 4.13 of CIS AWS Foundation Benchmark 1.4.0 ).

YAML Configuration

1type: trigger
2name: crowdsecurity/aws-cis-benchmark-route-table-change
3description: "Detect AWS route table change"
4filter: |
5     evt.Meta.log_type == 'aws-cloudtrail' &&
6     (
7     evt.Meta.event_name == "CreateRoute" ||
8     evt.Meta.event_name == "CreateRouteTable" ||
9     evt.Meta.event_name == "ReplaceRoute" ||
10     evt.Meta.event_name == "ReplaceRouteTableAssociation" ||
11     evt.Meta.event_name == "DeleteRouteTable" ||
12     evt.Meta.event_name == "DeleteRoute" ||
13     evt.Meta.event_name == "DisassociateRouteTable"
14     )
15labels:
16     confidence: 3
17     spoofable: 0
18     classification:
19          - attack.T1578
20     behavior: "cloud:audit"
21     label: "AWS route table change"
22     service: aws
23     cti: false
24     remediation: false
25

Hub configuration

« AWS route table change »v0.3 by crowdsecurity / aws-cis-benchmark-route-table-changeAttack scenarioawsNot spoofableHigh confidenceMITRE:T1578

« AWS route table change »
v0.3 by crowdsecurity / aws-cis-benchmark-route-table-change
Attack scenarioawsNot spoofableHigh confidence