Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

AWSCloudTrail - Changes to Amazon VPC settings

Identifies changes to Amazon VPC(Virtual Private Cloud) settings that can alter network exposure, routing, or access controls. This rule identifies changes to Amazon VPC (Virtual Private Cloud) settings such as new ACL entries, routes, routetable or Gateways. AWS VPC API Docs: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/OperationList-query-vpc.html'

ATT&CK coverage

Outside the enterprise matrix

T1078
T1686.001Cloud FirewallMapped as T1562.007, withdrawn by ATT&CK.

Detection requirements

Log source product: aws awss3
Log source service: awscloudtrail

What the source says

Tagged by the source as

DefenseEvasionPrivilegeEscalation

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.