AWS SecurityHub Findings Evasion

Description

Detects the modification of the findings on SecurityHub.

Query · sigma

selection:
  eventSource: securityhub.amazonaws.com
  eventName:
  - BatchUpdateFindings
  - DeleteInsight
  - UpdateFindings
  - UpdateInsight
condition: selection

Known false positives

  • System or Network administrator behaviors
  • DEV, UAT, SAT environment. You should apply this rule with PROD environment only.
Raw source AWS SecurityHub Findings Evasion · Sigma
Esc
Published by SigmaHQ/sigma ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
title: AWS SecurityHub Findings Evasion
id: a607e1fe-74bf-4440-a3ec-b059b9103157
status: stable
description: Detects the modification of the findings on SecurityHub.
references:
    - https://docs.aws.amazon.com/cli/latest/reference/securityhub/
author: Sittikorn S
date: 2021-06-28
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: securityhub.amazonaws.com
        eventName:
            - 'BatchUpdateFindings'
            - 'DeleteInsight'
            - 'UpdateFindings'
            - 'UpdateInsight'
    condition: selection
falsepositives:
    - System or Network administrator behaviors
    - DEV, UAT, SAT environment. You should apply this rule with PROD environment only.
level: high

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.