Possible disruption of CloudTrail Logging: Management events logging disabled with an event selector.

Description

Possible disruption of CloudTrail Logging: Management events logging disabled with an event selector.

Query · wazuh

field api.operation="PutEventSelectors"

Rule dependencies

Depends on

Raw source Possible disruption of CloudTrail Logging: Management events logging disabled with an event selector. · Wazuh XML
Esc
Published by Wazuh Core Ruleset ↗, licensed under GPLv2 ↗. Reproduced here unmodified. 
<rule id="99030" level="12">
    <if_group>asl_api_operation</if_group>
    <field name="api.operation">PutEventSelectors</field>
    <description>Possible disruption of CloudTrail Logging: Management events logging disabled with an event selector.</description>
    <mitre>
      <id>T1562.008</id>
    </mitre>
  </rule>

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.