1type: trigger
2name: crowdsecurity/aws-cis-benchmark-route-table-change
3description: "Detect AWS route table change"
4filter: |
5     evt.Meta.log_type == 'aws-cloudtrail' &&
6     (
7     evt.Meta.event_name == "CreateRoute" ||
8     evt.Meta.event_name == "CreateRouteTable" ||
9     evt.Meta.event_name == "ReplaceRoute" ||
10     evt.Meta.event_name == "ReplaceRouteTableAssociation" ||
11     evt.Meta.event_name == "DeleteRouteTable" ||
12     evt.Meta.event_name == "DeleteRoute" ||
13     evt.Meta.event_name == "DisassociateRouteTable"
14     )
15labels:
16     confidence: 3
17     spoofable: 0
18     classification:
19          - attack.T1578
20     behavior: "cloud:audit"
21     label: "AWS route table change"
22     service: aws
23     cti: false
24     remediation: false
25