detection-coverage.json

[
    {
        "AnalysisType": "Scheduled Rule",
        "Description": "Detects 1Password Logins from IP addresses not found in CrowdStrike's AIP list. May indicate unmanaged device being used, or faulty CrowdStrike Sensor.",
        "DisplayName": "1Password Login From CrowdStrike Unmanaged Device",
        "LogTypes": [
            "Crowdstrike.AIDMaster",
            "OnePassword.SignInAttempt"
        ],
        "YAMLPath": "queries/crowdstrike_queries/onepassword_login_from_crowdstrike_unmanaged_device.yml"
    },
    {
        "AnalysisType": "Scheduled Query",
        "Description": "Looks for OnePassword Logins from IP Addresses that aren't seen in CrowdStrike's AIP List.",
        "DisplayName": "1Password Login From CrowdStrike Unmanaged Device Query",
        "LogTypes": [
            "Crowdstrike.AIDMaster",
            "OnePassword.SignInAttempt"
        ],
        "YAMLPath": "queries/crowdstrike_queries/onepass_login_from_crowdstrike_unmanaged_device_query.yml"
    },
    {
        "AnalysisType": "Scheduled Query",
        "Description": "Looks for OnePassword Logins from IP Addresses that aren't seen in CrowdStrike's AIP List. (crowdstrike_fdrevent table)",
        "DisplayName": "1Password Login From CrowdStrike Unmanaged Device Query (crowdstrike_fdrevent table)",
        "LogTypes": [
            "Crowdstrike.FDREvent",
            "OnePassword.SignInAttempt"
        ],
        "YAMLPath": "queries/onepassword_queries/onepass_login_from_crowdstrike_unmanaged_device_FDREvent.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "Detects vulnerable versions of XZ and liblzma on Linux and MacOS using Osquery logs. Versions 5.6.0 and 5.6.1 of xz and liblzma are most likely vulnerable to backdoor exploit. Vuln management pack must be enabled: https://github.com/osquery/osquery/blob/master/packs/vuln-management.conf",
        "DisplayName": "A backdoored version of XZ or liblzma is vulnerable to CVE-2024-3094",
        "LogTypes": [
            "Osquery.Differential"
        ],
        "YAMLPath": "rules/osquery_rules/osquery_linux_mac_vulnerable_xz_liblzma.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "A CloudTrail Trail was created, updated, or enabled.",
        "DisplayName": "A CloudTrail Was Created or Updated",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "rules/aws_cloudtrail_rules/aws_cloudtrail_created.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "A system has been logged into from a non approved IP space.",
        "DisplayName": "A Login from Outside the Corporate Office",
        "LogTypes": [
            "Osquery.Differential"
        ],
        "YAMLPath": "rules/osquery_rules/osquery_linux_logins_non_office.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "An unusually long-lived Teleport certificate was created",
        "DisplayName": "A long-lived cert was created",
        "LogTypes": [
            "Gravitational.TeleportAudit"
        ],
        "YAMLPath": "rules/gravitational_teleport_rules/teleport_long_lived_certs.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "A SAML connector was created or modified",
        "DisplayName": "A SAML Connector was created or modified",
        "LogTypes": [
            "Gravitational.TeleportAudit"
        ],
        "YAMLPath": "rules/gravitational_teleport_rules/teleport_saml_created.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "A Teleport Lock was created",
        "DisplayName": "A Teleport Lock was created",
        "LogTypes": [
            "Gravitational.TeleportAudit"
        ],
        "YAMLPath": "rules/gravitational_teleport_rules/teleport_lock_created.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "A Teleport Role was modified or created",
        "DisplayName": "A Teleport Role was modified or created",
        "LogTypes": [
            "Gravitational.TeleportAudit"
        ],
        "YAMLPath": "rules/gravitational_teleport_rules/teleport_role_created.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "A user authenticated with SAML, but from an unknown company domain",
        "DisplayName": "A user authenticated with SAML, but from an unknown company domain",
        "LogTypes": [
            "Gravitational.TeleportAudit"
        ],
        "YAMLPath": "rules/gravitational_teleport_rules/teleport_saml_login_not_company_domain.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "A User from the company domain(s) Logged in without SAML",
        "DisplayName": "A User from the company domain(s) Logged in without SAML",
        "LogTypes": [
            "Gravitational.TeleportAudit"
        ],
        "YAMLPath": "rules/gravitational_teleport_rules/teleport_company_domain_login_without_saml.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "A Panther user role has been created that contains admin level permissions.",
        "DisplayName": "A User Role with Sensitive Permissions has been Created",
        "LogTypes": [
            "Panther.Audit"
        ],
        "YAMLPath": "rules/panther_audit_rules/panther_sensitive_role_created.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "A Panther user's role has been modified. This could mean password, email, or role has changed for the user.",
        "DisplayName": "A User's Panther Account was Modified",
        "LogTypes": [
            "Panther.Audit"
        ],
        "YAMLPath": "rules/panther_audit_rules/panther_user_modified.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "An account wide security configuration was changed.",
        "DisplayName": "Account Security Configuration Changed",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "rules/aws_cloudtrail_rules/aws_security_configuration_change.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "An action was performed by Netskope personnel.",
        "DisplayName": "Action Performed by Netskope Personnel",
        "LogTypes": [
            "Netskope.Audit"
        ],
        "YAMLPath": "rules/netskope_rules/netskope_personnel_action.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "An admin was logged out because of successive login failures.",
        "DisplayName": "Admin logged out because of successive login failures",
        "LogTypes": [
            "Netskope.Audit"
        ],
        "YAMLPath": "rules/netskope_rules/netskope_admin_logged_out.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "Assigning an admin role manually could be a sign of privilege escalation",
        "DisplayName": "Admin Role Assigned",
        "LogTypes": [
            "Asana.Audit",
            "Atlassian.Audit",
            "GCP.AuditLog",
            "GSuite.Reports",
            "GitHub.Audit",
            "OneLogin.Events",
            "Zendesk.Audit"
        ],
        "YAMLPath": "rules/standard_rules/admin_assigned.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "An Amazon Machine Image (AMI) was modified to allow it to be launched by anyone. Any sensitive configuration or application data stored in the AMI's block devices is at risk.",
        "DisplayName": "Amazon Machine Image (AMI) Modified to Allow Public Access",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "rules/aws_cloudtrail_rules/aws_ami_modified_for_public_access.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "An administrator account was created, deleted, or modified.",
        "DisplayName": "An administrator account was created, deleted, or modified.",
        "LogTypes": [
            "Netskope.Audit"
        ],
        "YAMLPath": "rules/netskope_rules/netskope_admin_user_change.yml"
    },
    {
        "AnalysisType": "Scheduled Query",
        "Description": "ARNs with a high Access Denied error rate could indicate an error or compromised credentials attempting to perform reconnaissance.",
        "DisplayName": "Anomalous AccessDenied Requests",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "queries/aws_queries/anomalous_access_denied_query.yml"
    },
    {
        "AnalysisType": "Saved Query",
        "Description": "Look at which VPC hosts have been sending a lot of traffic over the past hour",
        "DisplayName": "Anomalous VPC Traffic to Destination Port",
        "LogTypes": [
            "AWS.VPCFlow"
        ],
        "YAMLPath": "queries/aws_queries/anomalous_vpc_traffic_to_dest_port_query.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "",
        "DisplayName": "AppOmni Alert Passthrough",
        "LogTypes": [
            "AppOmni.Alerts"
        ],
        "YAMLPath": "rules/appomni_rules/appomni_alert_passthrough.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "An Asana service account was created by someone in your organization.",
        "DisplayName": "Asana Service Account Created",
        "LogTypes": [
            "Asana.Audit"
        ],
        "YAMLPath": "rules/asana_rules/asana_service_account_created.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "An Asana team's privacy setting was changed to public to the organization (not public to internet)",
        "DisplayName": "Asana Team Privacy Public",
        "LogTypes": [
            "Asana.Audit"
        ],
        "YAMLPath": "rules/asana_rules/asana_team_privacy_public.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "An Asana workspace's default session duration (how often users need to re-authenticate) has been changed to never.",
        "DisplayName": "Asana Workspace Default Session Duration Never",
        "LogTypes": [
            "Asana.Audit"
        ],
        "YAMLPath": "rules/asana_rules/asana_workspace_default_session_duration_never.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "A new email domain has been added to an Asana workspace. Reviewer should validate that the new domain is a part of the organization.",
        "DisplayName": "Asana Workspace Email Domain Added",
        "LogTypes": [
            "Asana.Audit"
        ],
        "YAMLPath": "rules/asana_rules/asana_workspace_email_domain_added.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "An Asana Workspace Form Link is a unique URL that allows you to create a task directly within a specific Workspace or Project in Asana, using a web form. Disabling authentication requirements may allow unauthorized users to create tasks.",
        "DisplayName": "Asana Workspace Form Link Auth Requirement Disabled",
        "LogTypes": [
            "Asana.Audit"
        ],
        "YAMLPath": "rules/asana_rules/asana_workspace_form_link_auth_requirement_disabled.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "Typically inviting guests to Asana is permitted by few users. Enabling anyone to invite guests can potentially lead to unauthorized users gaining access to Asana.",
        "DisplayName": "Asana Workspace Guest Invite Permissions Anyone",
        "LogTypes": [
            "Asana.Audit"
        ],
        "YAMLPath": "rules/asana_rules/asana_workspace_guest_invite_permissions_anyone.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "Admin role was granted to the user who previously did not have admin permissions",
        "DisplayName": "Asana Workspace New Admin",
        "LogTypes": [
            "Asana.Audit"
        ],
        "YAMLPath": "rules/asana_rules/asana_workspace_new_admin.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "An Asana user started an org export.",
        "DisplayName": "Asana Workspace Org Export",
        "LogTypes": [
            "Asana.Audit"
        ],
        "YAMLPath": "rules/asana_rules/asana_workspace_org_export.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "An asana user made your organization's password requirements less strict.",
        "DisplayName": "Asana Workspace Password Requirements Simple",
        "LogTypes": [
            "Asana.Audit"
        ],
        "YAMLPath": "rules/asana_rules/asana_workspace_password_requirements_simple.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "An Asana user turned off app approval requirements for an application type for your organization.",
        "DisplayName": "Asana Workspace Require App Approvals Disabled",
        "LogTypes": [
            "Asana.Audit"
        ],
        "YAMLPath": "rules/asana_rules/asana_workspace_require_app_approvals_disabled.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "An Asana user made SAML optional for your organization.",
        "DisplayName": "Asana Workspace SAML Optional",
        "LogTypes": [
            "Asana.Audit"
        ],
        "YAMLPath": "rules/asana_rules/asana_workspace_saml_optional.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "Reports when an Atlassian user logs in (impersonates) another user.",
        "DisplayName": "Atlassian admin impersonated another user",
        "LogTypes": [
            "Atlassian.Audit"
        ],
        "YAMLPath": "rules/atlassian_rules/user_logged_in_as_user.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "Okta has determined that the cross-origin authentication feature in Customer Identity Cloud (CIC) is prone to being targeted by threat actors orchestrating credential-stuffing attacks.  Okta has observed suspicious activity that started on April 15, 2024.  Review tenant logs for unexpected fcoa, scoa, and pwd_leak events.",
        "DisplayName": "Auth0 CIC Credential Stuffing",
        "LogTypes": [
            "Auth0.Events"
        ],
        "YAMLPath": "rules/auth0_rules/auth0_cic_credential_stuffing.yml"
    },
    {
        "AnalysisType": "Saved Query",
        "Description": "Okta has determined that the cross-origin authentication feature in Customer Identity Cloud (CIC) is prone to being targeted by threat actors orchestrating credential-stuffing attacks.  Okta has observed suspicious activity that started on April 15, 2024.  Review tenant logs for unexpected fcoa, scoa, and pwd_leak events.  https://sec.okta.com/articles/2024/05/detecting-cross-origin-authentication-credential-stuffing-attacks",
        "DisplayName": "Auth0 CIC Credential Stuffing Query",
        "LogTypes": [
            "Auth0.Events"
        ],
        "YAMLPath": "queries/auth0_queries/auth0_cic_credential_stuffing_query.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "An Auth0 User created a role in your organization's tenant.",
        "DisplayName": "Auth0 Custom Role Created",
        "LogTypes": [
            "Auth0.Events"
        ],
        "YAMLPath": "rules/auth0_rules/auth0_custom_role_created.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "An Auth0 integration was installed from the auth0 action library.",
        "DisplayName": "Auth0 Integration Installed",
        "LogTypes": [
            "Auth0.Events"
        ],
        "YAMLPath": "rules/auth0_rules/auth0_integration_installed.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "An Auth0 user enabled an mfa factor in your organization's mfa settings.",
        "DisplayName": "Auth0 mfa factor enabled",
        "LogTypes": [
            "Auth0.Events"
        ],
        "YAMLPath": "rules/auth0_rules/auth0_mfa_factor_setting_enabled.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "An Auth0 User disabled MFA for your organization's tenant.",
        "DisplayName": "Auth0 MFA Policy Disabled",
        "LogTypes": [
            "Auth0.Events"
        ],
        "YAMLPath": "rules/auth0_rules/auth0_mfa_policy_disabled.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "An Auth0 User enabled MFA Policy for your organization's tenant.",
        "DisplayName": "Auth0 MFA Policy Enabled",
        "LogTypes": [
            "Auth0.Events"
        ],
        "YAMLPath": "rules/auth0_rules/auth0_mfa_policy_enabled.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "An Auth0 User disabled the mfa risk assessment setting for your organization's tenant.",
        "DisplayName": "Auth0 MFA Risk Assessment Disabled",
        "LogTypes": [
            "Auth0.Events"
        ],
        "YAMLPath": "rules/auth0_rules/auth0_mfa_risk_assessment_disabled.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "An Auth0 User enabled the mfa risk assessment setting for your organization's tenant.",
        "DisplayName": "Auth0 MFA Risk Assessment Enabled",
        "LogTypes": [
            "Auth0.Events"
        ],
        "YAMLPath": "rules/auth0_rules/auth0_mfa_risk_assessment_enabled.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "An Auth0 User updated a post login action flow for your organization's tenant.",
        "DisplayName": "Auth0 Post Login Action Flow Updated",
        "LogTypes": [
            "Auth0.Events"
        ],
        "YAMLPath": "rules/auth0_rules/auth0_post_login_action_flow.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "",
        "DisplayName": "Auth0 User Invitation Created",
        "LogTypes": [
            "Auth0.Events"
        ],
        "YAMLPath": "rules/auth0_rules/auth0_user_invitation_created.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "User accepted invitation from Auth0 member to join an Auth0 tenant.",
        "DisplayName": "Auth0 User Joined Tenant",
        "LogTypes": [
            "Auth0.Events"
        ],
        "YAMLPath": "rules/auth0_rules/auth0_user_joined_tenant.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "This policy validates that AWS IAM account access keys are rotated every 90 days. Rotating access keys will reduce the window of opportunity for an access key that is associated with a compromised or terminated account to be used.",
        "DisplayName": "AWS Access Key Rotation",
        "LogTypes": [
            "AWS.IAM.RootUser",
            "AWS.IAM.User"
        ],
        "YAMLPath": "policies/aws_iam_policies/aws_access_key_rotation.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "This policy validates that AWS IAM user accounts do not have access keys that were created during account creation. This results in excess keys being generated, and unnecessary management work in auditing and rotating these keys.",
        "DisplayName": "AWS Access Keys At Account Creation",
        "LogTypes": [
            "AWS.IAM.RootUser",
            "AWS.IAM.User"
        ],
        "YAMLPath": "policies/aws_iam_policies/aws_access_keys_at_account_creation.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "When a certificate is 60 days away from expiration, ACM automatically attempts to renew it every hour.",
        "DisplayName": "AWS ACM Certificate Expiration",
        "LogTypes": [
            "AWS.ACM.Certificate"
        ],
        "YAMLPath": "policies/aws_acm_policies/aws_acm_certificate_expiration.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "This policy checks if an ACM certificate renewal is pending or has failed and is in use by any other resources within the account.",
        "DisplayName": "AWS ACM Certificate Status",
        "LogTypes": [
            "AWS.ACM.Certificate"
        ],
        "YAMLPath": "policies/aws_acm_policies/aws_acm_certificate_valid.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "This policy validates that all ACM certificates are using secure key and signature algorithms.",
        "DisplayName": "AWS ACM Secure Algorithms",
        "LogTypes": [
            "AWS.ACM.Certificate"
        ],
        "YAMLPath": "policies/aws_acm_policies/aws_acm_certificate_has_secure_algorithms.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "This policy ensures that AMIs you have created are not configured to allow public access, which could result in accidental data loss. AMI's that you use but do not own are not evaluated by this policy.",
        "DisplayName": "AWS AMI Sharing",
        "LogTypes": [
            "AWS.EC2.AMI"
        ],
        "YAMLPath": "policies/aws_ec2_policies/aws_ami_private.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "This policy validates that all application load balancers have an associated Web ACl to enforce protections against various web attacks.",
        "DisplayName": "AWS Application Load Balancer Web ACL",
        "LogTypes": [
            "AWS.ELBV2.ApplicationLoadBalancer"
        ],
        "YAMLPath": "policies/aws_elb_policies/aws_application_load_balancer_web_acl.yml"
    },
    {
        "AnalysisType": "Scheduled Query",
        "Description": "Detects AWS Authentication events with IP Addresses not found in CrowdStrike's AIP List",
        "DisplayName": "AWS Authentication from CrowdStrike Unmanaged Device",
        "LogTypes": [
            "AWS.CloudTrail",
            "Crowdstrike.AIDMaster"
        ],
        "YAMLPath": "queries/crowdstrike_queries/AWS_Authentication_from_CrowdStrike_Unmanaged_Device_Query.yml"
    },
    {
        "AnalysisType": "Scheduled Query",
        "Description": "Detects AWS Authentication events with IP Addresses not found in CrowdStrike's AIP List",
        "DisplayName": "AWS Authentication from CrowdStrike Unmanaged Device (crowdstrike_fdrevent table)",
        "LogTypes": [
            "AWS.CloudTrail",
            "Crowdstrike.FDREvent"
        ],
        "YAMLPath": "queries/aws_queries/AWS_Authentication_from_CrowdStrike_Unmanaged_Device_FDREvent.yml"
    },
    {
        "AnalysisType": "Correlation Rule",
        "Description": "Identifies when CreateRole and AttachAdminRolePolicy CloudTrail events occur in a short period of time. This sequence could indicate a potential security breach.",
        "DisplayName": "AWS Backdoor Administrative IAM Role Created",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "correlation_rules/aws_create_backdoor_admin_iam_role.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "An Amazon Bedrock Guardrail was updated or deleted. Amazon Bedrock Guardrails are used to implement application-specific safeguards based on your use cases and responsible AI policies. Updating or deleting a guardrail can have security implications to your AI workloads.",
        "DisplayName": "AWS Bedrock Guardrail Updated or Deleted",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "rules/aws_cloudtrail_rules/aws_bedrock_guardrail_update_delete.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "An Amazon Bedrock Model Invocation Logging Configuration was deleted. Use model invocation logging to collect metadata, requests, and responses for all model invocations in your account. Deleting a model invocation logging configuration can have security implications to your AI workloads.",
        "DisplayName": "AWS Bedrock Model Invocation Logging Configuration Deleted",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "rules/aws_cloudtrail_rules/aws_bedrock_deletemodelinvocationloggingconfiguration.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "This policy ensures that all EC2 volumes that contain CDE are encrypted. Be sure to configure CDE definitions before enabling this policy.",
        "DisplayName": "AWS CDE EC2 Volume Encryption",
        "LogTypes": [
            "AWS.EC2.Volume"
        ],
        "YAMLPath": "policies/aws_ec2_policies/aws_ec2_cde_volume_encrypted.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "A stack has drifted from its defined configuration.",
        "DisplayName": "AWS CloudFormation Stack Drift",
        "LogTypes": [
            "AWS.CloudFormation.Stack"
        ],
        "YAMLPath": "policies/aws_cloudformation_policies/aws_cloudformation_stack_drifted.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "Associating IAM roles with CloudFormation stacks ensures least privilege when making changes to your account.",
        "DisplayName": "AWS CloudFormation Stack IAM Service Role",
        "LogTypes": [
            "AWS.CloudFormation.Stack"
        ],
        "YAMLPath": "policies/aws_cloudformation_policies/aws_cloudformation_stack_uses_iam_role.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "Protects a CloudFormation stack from accidentally being deleted. If you attempt to delete a stack with termination protection enabled, the deletion fails and the stack, including its status, will remain unchanged.",
        "DisplayName": "AWS CloudFormation Stack Termination Protection",
        "LogTypes": [
            "AWS.CloudFormation.Stack"
        ],
        "YAMLPath": "policies/aws_cloudformation_policies/aws_cloudformation_termination_protection.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.",
        "DisplayName": "AWS CloudTrail Account Discovery",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "rules/aws_cloudtrail_rules/aws_cloudtrail_account_discovery.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "Detects when an actor attempts to remove an AWS account from an Organization. Security configurations are often defined at the organizational level. Leaving the organization can disrupt or totally shut down these controls.",
        "DisplayName": "AWS CloudTrail Attempt To Leave Org",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "rules/aws_cloudtrail_rules/aws_cloudtrail_attempt_to_leave_org.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "CloudTrail supports sending data and management events to CloudWatch Logs. This setup can be used for real-time processing of all CloudTrail data events.",
        "DisplayName": "AWS CloudTrail CloudWatch Logs",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "policies/aws_cloudtrail_policies/aws_cloudtrail_cloudwatch_logs.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "Users with permissions to disable or reconfigure CloudTrail should be limited.",
        "DisplayName": "AWS CloudTrail Least Privilege Access",
        "LogTypes": [
            "AWS.IAM.Group"
        ],
        "YAMLPath": "policies/aws_iam_policies/aws_cloudtrail_least_privilege.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "This policy validates that CloudTrail Logs are encrypted at rest with customer managed KMS key.",
        "DisplayName": "AWS CloudTrail Log Encryption",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "policies/aws_cloudtrail_policies/aws_cloudtrail_log_encryption.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "This policy ensures that CloudTrail logs have file integrity validation enabled.",
        "DisplayName": "AWS CloudTrail Log Validation",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "policies/aws_cloudtrail_policies/aws_cloudtrail_log_validation.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "This policy ensures that at least one CloudTrail has management (control plane) operations logged.",
        "DisplayName": "AWS CloudTrail Management Events Enabled",
        "LogTypes": [
            "AWS.CloudTrail.Meta"
        ],
        "YAMLPath": "policies/aws_cloudtrail_policies/aws_cloudtrail_enabled.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "This detection looks for *AccountPasswordPolicy events in AWS CloudTrail logs. If these events occur in a short period of time from the same ARN, it could constitute Password Policy reconnaissance.",
        "DisplayName": "AWS CloudTrail Password Policy Discovery",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "rules/aws_cloudtrail_rules/aws_cloudtrail_password_policy_discovery.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "Threat actors who successfully compromise a victim's AWS account, whether through stolen credentials,  exposed access keys, exploited IAM misconfigurations, vulnerabilities in third-party applications,  or the absence of Multi-Factor Authentication (MFA), can exploit unused regions as safe zones  for malicious activities. These regions are often overlooked in monitoring and security setups,  making them an attractive target for attackers to operate undetected.",
        "DisplayName": "AWS Cloudtrail Region Enabled",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "rules/aws_cloudtrail_rules/aws_cloudtrail_region_enabled.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "Detects when an S3 bucket containing CloudTrail logs has been modified to delete data after a short period of time.",
        "DisplayName": "AWS CloudTrail Retention Lifecycle Too Short",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "rules/aws_cloudtrail_rules/aws_cloudtrail_short_lifecycle.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "This policy validates that the bucket receiving CloudTrail Logs is configured with S3 Access Logging. This audits all creation, modification, or deletion to CloudTrail audit logs.",
        "DisplayName": "AWS CloudTrail S3 Bucket Access Logging",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "policies/aws_cloudtrail_policies/aws_cloudtrail_s3_bucket_access_logging.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "This policy validates that CloudTrail S3 buckets are not publicly accessible.",
        "DisplayName": "AWS CloudTrail S3 Bucket Public",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "policies/aws_cloudtrail_policies/aws_cloudtrail_s3_bucket_public.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "",
        "DisplayName": "AWS CloudTrail SES Check Identity Verifications",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "rules/aws_cloudtrail_rules/aws_cloudtrail_ses_check_identity_verifications.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "Detect when someone checks how many emails can be delivered via SES",
        "DisplayName": "AWS CloudTrail SES Check Send Quota",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "rules/aws_cloudtrail_rules/aws_cloudtrail_ses_check_send_quota.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "Detect when a user inquires whether SES Sending is enabled.",
        "DisplayName": "AWS CloudTrail SES Check SES Sending Enabled",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "rules/aws_cloudtrail_rules/aws_cloudtrail_ses_check_ses_sending_enabled.yml"
    },
    {
        "AnalysisType": "Correlation Rule",
        "Description": "",
        "DisplayName": "AWS CloudTrail SES Enumeration",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "rules/aws_cloudtrail_rules/aws_cloudtrail_ses_enumeration.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "",
        "DisplayName": "AWS CloudTrail SES List Identities",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "rules/aws_cloudtrail_rules/aws_cloudtrail_ses_list_identities.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "AWS automatically performs server-side encryption of logs, but you can encrypt with your own CMK to protect extra sensitive log data.",
        "DisplayName": "AWS CloudWatch Log Encryption",
        "LogTypes": [
            "AWS.CloudWatch.LogGroup"
        ],
        "YAMLPath": "policies/aws_cloudwatch_policies/aws_cloudwatch_loggroup_encrypted.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "By default, logs are kept indefinitely and never expire. You can adjust the retention policy for each log group, keeping the indefinite retention, or choosing a specific retention period.",
        "DisplayName": "AWS CloudWatch Logs Data Retention",
        "LogTypes": [
            "AWS.CloudWatch.LogGroup"
        ],
        "YAMLPath": "policies/aws_cloudwatch_policies/aws_cloudwatch_loggroup_data_retention.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "An AWS command was executed on a Linux instance",
        "DisplayName": "AWS command executed on the command line",
        "LogTypes": [
            "Osquery.Differential"
        ],
        "YAMLPath": "rules/osquery_rules/osquery_linux_aws_commands.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "Detects when an IAM user has the AWSCompromisedKeyQuarantineV2 policy attached to their account.",
        "DisplayName": "AWS Compromised IAM Key Quarantine",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "rules/aws_cloudtrail_rules/aws_iam_compromised_key_quarantine.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "You can have AWS Config record supported types of global resources, such as IAM users, groups, roles, and customer managed policies.",
        "DisplayName": "AWS Config Global Resources",
        "LogTypes": [
            "AWS.Config.Recorder.Meta"
        ],
        "YAMLPath": "policies/aws_config_policies/aws_config_global_resources.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "This policy ensures that the config recorder is operational and capturing changes to your account without error.",
        "DisplayName": "AWS Config Recording Status",
        "LogTypes": [
            "AWS.Config.Recorder"
        ],
        "YAMLPath": "policies/aws_config_policies/aws_config_recording_no_error.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "This policy ensurers that you have a comprehensive configuration audit in place for all resource types in AWS.",
        "DisplayName": "AWS Config Records All Resource Types",
        "LogTypes": [
            "AWS.Config.Recorder"
        ],
        "YAMLPath": "policies/aws_config_policies/aws_config_all_resource_types.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "An AWS Config Recorder or Delivery Channel was created",
        "DisplayName": "AWS Config Service Created",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "rules/aws_cloudtrail_rules/aws_config_service_created.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "An AWS Config Recorder or Delivery Channel was disabled or deleted",
        "DisplayName": "AWS Config Service Disabled",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "rules/aws_cloudtrail_rules/aws_config_service_disabled_deleted.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "This policy ensures that the config recorder is operational and capturing changes to your account.",
        "DisplayName": "AWS Config Status",
        "LogTypes": [
            "AWS.Config.Recorder"
        ],
        "YAMLPath": "policies/aws_config_policies/aws_config_recording_enabled.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "",
        "DisplayName": "AWS Console Login",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "rules/aws_cloudtrail_rules/aws_console_login.yml"
    },
    {
        "AnalysisType": "Correlation Rule",
        "Description": "A user has logged into the AWS console without authenticating via Okta.  This rule requires AWS SSO via Okta and both log sources configured.",
        "DisplayName": "AWS Console Sign-In NOT PRECEDED BY Okta Redirect",
        "LogTypes": [
            "AWS.CloudTrail",
            "Okta.SystemLog"
        ],
        "YAMLPath": "correlation_rules/aws_console_sign-in_without_okta.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "Identify principles retrieving a high number of SSM Parameters of type 'SecretString'.",
        "DisplayName": "AWS Decrypt SSM Parameters",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "rules/aws_cloudtrail_rules/aws_ssm_decrypt_ssm_params.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "Identifies clients that may be performing DNS lookups associated with common currency mining pools.",
        "DisplayName": "AWS DNS Crypto Domain",
        "LogTypes": [
            "AWS.VPCDns",
            "OCSF.DnsActivity"
        ],
        "YAMLPath": "rules/aws_vpc_flow_rules/aws_dns_crypto_domain.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "Detects when logs for a DNS Resolver have been removed.",
        "DisplayName": "AWS DNS Logs Deleted",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "rules/aws_cloudtrail_rules/aws_dns_logs_deleted.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "DynamoDB Auto Scaling can dynamically adjust provisioned throughput capacity in response to traffic patterns. This enables a table to increase its provisioned read and write capacity to handle sudden increases in traffic",
        "DisplayName": "AWS DynamoDB Table Autoscaling",
        "LogTypes": [
            "AWS.DynamoDB.Table"
        ],
        "YAMLPath": "policies/aws_dynamodb_policies/aws_dynamodb_autoscaling.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "DynamoDB Auto Scaling can dynamically adjust provisioned throughput capacity in response to traffic patterns. This enables a table to increase its provisioned read and write capacity to handle sudden increases in traffic",
        "DisplayName": "AWS DynamoDB Table Autoscaling Configuration",
        "LogTypes": [
            "AWS.DynamoDB.Table"
        ],
        "YAMLPath": "policies/aws_dynamodb_policies/aws_dynamodb_autoscaling_configuration.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "This policy validates that all DynamoDB tables have a TTL field configured.",
        "DisplayName": "AWS DynamoDB Table TTL",
        "LogTypes": [
            "AWS.DynamoDB.Table"
        ],
        "YAMLPath": "policies/aws_dynamodb_policies/aws_dynamodb_table_ttl_enabled.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "Checks that AWS EC2 AMI's are only launched on approved dedicated hosts.",
        "DisplayName": "AWS EC2 AMI Approved Host",
        "LogTypes": [
            "AWS.EC2.Instance"
        ],
        "YAMLPath": "policies/aws_ec2_policies/aws_ec2_ami_approved_host.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "This policy ensures that the EC2 instance is running with an instance type approved for its AMI.",
        "DisplayName": "AWS EC2 AMI Approved Instance Type",
        "LogTypes": [
            "AWS.EC2.Instance"
        ],
        "YAMLPath": "policies/aws_ec2_policies/aws_ec2_ami_approved_instance_type.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "This policy ensures that the EC2 instance was launched with a tenancy approved for its AMI.",
        "DisplayName": "AWS EC2 AMI Approved Tenancy",
        "LogTypes": [
            "AWS.EC2.Instance"
        ],
        "YAMLPath": "policies/aws_ec2_policies/aws_ec2_ami_approved_tenancy.yml"
    },
    {
        "AnalysisType": "Scheduled Query",
        "Description": "Multiple different discovery commands were executed by the same EC2 instance.",
        "DisplayName": "AWS EC2 Discovery Commands Executed",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "queries/aws_queries/ec2_discovery_commands_query.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "An entity has accessed the user data scripts of multiple EC2 instances.",
        "DisplayName": "AWS EC2 Download Instance User Data",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "rules/aws_cloudtrail_rules/aws_ec2_download_instance_user_data.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "Identifies disabling of default EBS encryption. Disabling default encryption does not change the encryption status of existing volumes.",
        "DisplayName": "AWS EC2 EBS Encryption Disabled",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "rules/aws_cloudtrail_rules/aws_ec2_ebs_encryption_disabled.yml"
    },
    {
        "AnalysisType": "Rule",
        "Description": "Checks CloudTrail for occurrences of EC2 Image Actions.",
        "DisplayName": "AWS EC2 Image Monitoring",
        "LogTypes": [
            "AWS.CloudTrail"
        ],
        "YAMLPath": "rules/aws_cloudtrail_rules/aws_ec2_monitoring.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "This policy ensures the given EC2 instance is running an AMI from the approved list of AMI's.",
        "DisplayName": "AWS EC2 Instance Approved AMI",
        "LogTypes": [
            "AWS.EC2.Instance"
        ],
        "YAMLPath": "policies/aws_ec2_policies/aws_ec2_instance_approved_ami.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "This policy ensures the given EC2 Instance is running on an approved dedicated host.",
        "DisplayName": "AWS EC2 Instance Approved Host",
        "LogTypes": [
            "AWS.EC2.Instance"
        ],
        "YAMLPath": "policies/aws_ec2_policies/aws_ec2_instance_approved_host.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "This policy ensures that the EC2 instance is running on one of the approved instance types.",
        "DisplayName": "AWS EC2 Instance Approved Instance Type",
        "LogTypes": [
            "AWS.EC2.Instance"
        ],
        "YAMLPath": "policies/aws_ec2_policies/aws_ec2_instance_approved_instance_type.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "This policy ensures the given EC2 Instance is running with an approved tenancy option. The possible tenancy options are dedicated, host, and default.",
        "DisplayName": "AWS EC2 Instance Approved Tenancy",
        "LogTypes": [
            "AWS.EC2.Instance"
        ],
        "YAMLPath": "policies/aws_ec2_policies/aws_ec2_instance_approved_tenancy.yml"
    },
    {
        "AnalysisType": "Policy",
        "Description": "This policy ensures that the given EC2 Instance is running in an approved VPC.",