Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

AWSCloudTrail - Changes to AWS Elastic Load Balancer security groups

Detects AWS CloudTrail events that modify Elastic Load Balancer security group associations. Unauthorized changes can expose services to unintended network access or weaken cloud boundary protections. Validate these updates against approved change control and deployment activity.

ATT&CK coverage

Outside the enterprise matrix

T1686.001Cloud FirewallMapped as T1562.007, withdrawn by ATT&CK.

Detection requirements

Log source product: aws awss3
Log source service: awscloudtrail

What the source says

Tagged by the source as

DefenseEvasion

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.