From 56364e9e05fa5cc79ddfa7ded134e5d2662b734d Mon Sep 17 00:00:00 2001 From: gowthamarajr Date: Tue, 19 Jul 2022 12:21:01 -0400 Subject: [PATCH] Update References --- .../cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml | 3 ++- detections/cloud/aws_defense_evasion_update_cloudtrail.yml | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml b/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml index 1d868fb74c..8bcb71bbbc 100644 --- a/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml +++ b/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml @@ -16,7 +16,7 @@ how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs known_false_positives: While this search has no known false positives, it is possible that an AWS admin has deleted CloudWatch logging. Please investigate this activity. references: -- REFERENCE +- https://attack.mitre.org/techniques/T1562/008/ tags: analytic_story: - AWS Defense Evasion @@ -35,6 +35,7 @@ tags: - Actions on Objectives message: User $user_arn$ has deleted a CloudWatch logging group for account id $aws_account_id$ from IP $src$ mitre_attack_id: + - T1562 - T1562.008 nist: - DE.CM diff --git a/detections/cloud/aws_defense_evasion_update_cloudtrail.yml b/detections/cloud/aws_defense_evasion_update_cloudtrail.yml index 142880d173..33c2278808 100644 --- a/detections/cloud/aws_defense_evasion_update_cloudtrail.yml +++ b/detections/cloud/aws_defense_evasion_update_cloudtrail.yml @@ -17,7 +17,7 @@ how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs known_false_positives: While this search has no known false positives, it is possible that an AWS admin has updated cloudtrail logging. Please investigate this activity. references: -- REFERENCE +- https://attack.mitre.org/techniques/T1562/008/ tags: analytic_story: - AWS Defense Evasion @@ -36,6 +36,7 @@ tags: - Actions on Objectives message: User $user_arn$ has updated a cloudtrail logging for account id $aws_account_id$ from IP $src$ mitre_attack_id: + - T1562 - T1562.008 nist: - DE.CM