Sunturai
Back to results
InformationalSplunk security contentBhavin Patel +1

Cloud Security Groups Modifications by User

The following analytic identifies unusual modifications to security groups in your cloud environment by users, focusing on actions such as modifications, deletions, or creations over 30-minute intervals. It leverages…

Description

The following analytic identifies unusual modifications to security groups in your cloud environment by users, focusing on actions such as modifications, deletions, or creations over 30-minute intervals. It leverages cloud infrastructure logs and calculates the standard deviation for each user, using the 3-sigma rule to detect anomalies. This activity is significant as it may indicate a compromised account or insider threat. If confirmed malicious, attackers could alter security group configurations, potentially exposing sensitive resources or disrupting services.

Detection logic

Detection requirements

Platform
IaaS

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
aws_cloudtrail

Known benign triggers

  • It is possible that legitimate user/admin may modify a number of security groups

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice