- Elastic Security: other versions:
- Elastic Security overview
- What’s new
- Get started with Elastic Security
- Elastic Security UI
- Anomaly Detection with Machine Learning
- Detections and Alerts (beta)
- Creating detection rules
- Managing detection rules
- Monitoring and troubleshooting rule executions
- Rule exceptions and value lists
- About building-block rules
- Managing detection alerts
- Tuning prebuilt detection rules
- Prebuilt rule changes per release
- Prebuilt rule reference
- AWS Access Secret in Secrets Manager
- AWS CloudTrail Log Created
- AWS CloudTrail Log Deleted
- AWS CloudTrail Log Suspended
- AWS CloudTrail Log Updated
- AWS CloudWatch Alarm Deletion
- AWS CloudWatch Log Group Deletion
- AWS CloudWatch Log Stream Deletion
- AWS Config Service Tampering
- AWS Configuration Recorder Stopped
- AWS EC2 Encryption Disabled
- AWS EC2 Flow Log Deletion
- AWS EC2 Network Access Control List Creation
- AWS EC2 Network Access Control List Deletion
- AWS EC2 Snapshot Activity
- AWS Execution via System Manager
- AWS GuardDuty Detector Deletion
- AWS IAM Assume Role Policy Update
- AWS IAM Brute Force of Assume Role Policy
- AWS IAM Deactivation of MFA Device
- AWS IAM Group Creation
- AWS IAM Group Deletion
- AWS IAM Password Recovery Requested
- AWS IAM User Addition to Group
- AWS Management Console Root Login
- AWS RDS Cluster Creation
- AWS RDS Cluster Deletion
- AWS RDS Instance/Cluster Stoppage
- AWS Root Login Without MFA
- AWS S3 Bucket Configuration Deletion
- AWS WAF Access Control List Deletion
- AWS WAF Rule or Rule Group Deletion
- Adding Hidden File Attribute via Attrib
- Administrator Privileges Assigned to Okta Group
- Adobe Hijack Persistence
- Adversary Behavior - Detected - Elastic Endpoint Security
- Anomalous Process For a Linux Population
- Anomalous Process For a Windows Population
- Anomalous Windows Process Creation
- Attempt to Create Okta API Token
- Attempt to Deactivate MFA for Okta User Account
- Attempt to Deactivate Okta MFA Rule
- Attempt to Deactivate Okta Policy
- Attempt to Delete Okta Policy
- Attempt to Disable IPTables or Firewall
- Attempt to Disable Syslog Service
- Attempt to Modify Okta MFA Rule
- Attempt to Modify Okta Network Zone
- Attempt to Modify Okta Policy
- Attempt to Reset MFA Factors for Okta User Account
- Attempt to Revoke Okta API Token
- Attempted Bypass of Okta MFA
- Base16 or Base32 Encoding/Decoding Activity
- Base64 Encoding/Decoding Activity
- Bypass UAC via Event Viewer
- Clearing Windows Event Logs
- Command Prompt Network Connection
- Connection to External Network via Telnet
- Connection to Internal Network via Telnet
- Creation of Hidden Files and Directories
- Credential Dumping - Detected - Elastic Endpoint Security
- Credential Dumping - Prevented - Elastic Endpoint Security
- Credential Manipulation - Detected - Elastic Endpoint Security
- Credential Manipulation - Prevented - Elastic Endpoint Security
- DNS Activity to the Internet
- DNS Tunneling
- Delete Volume USN Journal with Fsutil
- Deleting Backup Catalogs with Wbadmin
- Deletion of Bash Command Line History
- Direct Outbound SMB Connection
- Disable Windows Firewall Rules via Netsh
- Elastic Endpoint Security
- Encoding or Decoding Files via CertUtil
- Enumeration of Kernel Modules
- Execution via Regsvcs/Regasm
- Exploit - Detected - Elastic Endpoint Security
- Exploit - Prevented - Elastic Endpoint Security
- External Alerts
- FTP (File Transfer Protocol) Activity to the Internet
- File Deletion via Shred
- File Permission Modification in Writable Directory
- Hex Encoding/Decoding Activity
- Hping Process Activity
- IPSEC NAT Traversal Port Activity
- IRC (Internet Relay Chat) Protocol Activity to the Internet
- Interactive Terminal Spawned via Perl
- Interactive Terminal Spawned via Python
- Kernel Module Removal
- Local Scheduled Task Commands
- Local Service Commands
- Malware - Detected - Elastic Endpoint Security
- Malware - Prevented - Elastic Endpoint Security
- Microsoft Build Engine Loading Windows Credential Libraries
- Microsoft Build Engine Started an Unusual Process
- Microsoft Build Engine Started by a Script Process
- Microsoft Build Engine Started by a System Process
- Microsoft Build Engine Started by an Office Application
- Microsoft Build Engine Using an Alternate Name
- Mknod Process Activity
- Modification of Boot Configuration
- Modification or Removal of an Okta Application Sign-On Policy
- MsBuild Making Network Connections
- Net command via SYSTEM account
- Netcat Network Activity
- Network Connection via Certutil
- Network Connection via Compiled HTML File
- Network Connection via MsXsl
- Network Connection via Mshta
- Network Connection via Regsvr
- Network Connection via Signed Binary
- Network Sniffing via Tcpdump
- Nmap Process Activity
- Nping Process Activity
- Okta Brute Force or Password Spraying Attack
- PPTP (Point to Point Tunneling Protocol) Activity
- Permission Theft - Detected - Elastic Endpoint Security
- Permission Theft - Prevented - Elastic Endpoint Security
- Persistence via Kernel Module Modification
- Possible Okta DoS Attack
- Potential Application Shimming via Sdbinst
- Potential DNS Tunneling via Iodine
- Potential Disabling of SELinux
- Potential Evasion via Filter Manager
- Potential Modification of Accessibility Binaries
- Potential Shell via Web Server
- PowerShell spawning Cmd
- Process Activity via Compiled HTML File
- Process Discovery via Tasklist
- Process Injection - Detected - Elastic Endpoint Security
- Process Injection - Prevented - Elastic Endpoint Security
- Process Injection by the Microsoft Build Engine
- Proxy Port Activity to the Internet
- PsExec Network Connection
- RDP (Remote Desktop Protocol) from the Internet
- RDP (Remote Desktop Protocol) to the Internet
- RPC (Remote Procedure Call) from the Internet
- RPC (Remote Procedure Call) to the Internet
- Ransomware - Detected - Elastic Endpoint Security
- Ransomware - Prevented - Elastic Endpoint Security
- Rare AWS Error Code
- SMB (Windows File Sharing) Activity to the Internet
- SMTP on Port 26/TCP
- SMTP to the Internet
- SQL Traffic to the Internet
- SSH (Secure Shell) from the Internet
- SSH (Secure Shell) to the Internet
- Setgid Bit Set via chmod
- Setuid Bit Set via chmod
- Socat Process Activity
- Spike in AWS Error Messages
- Strace Process Activity
- Sudoers File Modification
- Suspicious Activity Reported by Okta User
- Suspicious MS Office Child Process
- Suspicious MS Outlook Child Process
- Suspicious PDF Reader Child Process
- Suspicious Powershell Script
- Svchost spawning Cmd
- System Shells via Services
- TCP Port 8000 Activity to the Internet
- Telnet Port Activity
- Threat Detected by Okta ThreatInsight
- Tor Activity to the Internet
- Trusted Developer Application Usage
- Unusual AWS Command for a User
- Unusual City For an AWS Command
- Unusual Country For an AWS Command
- Unusual DNS Activity
- Unusual Linux Network Activity
- Unusual Linux Network Port Activity
- Unusual Linux Network Service
- Unusual Linux Username
- Unusual Linux Web Activity
- Unusual Login Activity
- Unusual Network Connection via RunDLL32
- Unusual Network Destination Domain Name
- Unusual Parent-Child Relationship
- Unusual Process Execution - Temp
- Unusual Process For a Linux Host
- Unusual Process For a Windows Host
- Unusual Process Network Connection
- Unusual Web Request
- Unusual Web User Agent
- Unusual Windows Network Activity
- Unusual Windows Path Activity
- Unusual Windows Remote User
- Unusual Windows Service
- Unusual Windows User Privilege Elevation Activity
- Unusual Windows Username
- User Account Creation
- User Discovery via Whoami
- VNC (Virtual Network Computing) from the Internet
- VNC (Virtual Network Computing) to the Internet
- Virtual Machine Fingerprinting
- Volume Shadow Copy Deletion via VssAdmin
- Volume Shadow Copy Deletion via WMIC
- Web Application Suspicious Activity: No User Agent
- Web Application Suspicious Activity: POST Request Declined
- Web Application Suspicious Activity: Unauthorized Method
- Web Application Suspicious Activity: sqlmap User Agent
- Whoami Process Activity
- Windows CryptoAPI Spoofing Vulnerability (CVE-2020-0601 - CurveBall)
- Windows Script Executing PowerShell
- Investigate events
- Cases (beta)
- Elastic Security APIs
- Detections API
- Exceptions API
- Lists API
- Timeline API
- Cases API
- Create case
- Add comment
- Update case
- Update comment
- Find cases
- Get case
- Get all case comments
- Get comment
- Get all case activity
- Get tags
- Get reporters
- Get status
- Delete comment
- Delete all comments
- Delete case
- Set default Elastic Security UI connector
- Update case configurations
- Get current connector
- Find connectors
- Add external details to case
- Actions API (for pushing cases to external systems)
- Elastic Security fields and object schemas
- Enable process analyzer after upgrade
- Release Notes
AWS IAM Group Deletion
editAWS IAM Group Deletion
editIdentifies the deletion of a specific AWS Identity and Access Management (IAM) resource group. Deleting a resource group does not delete resources that are members of the group, only the group structure.
Rule type: query
Rule indices:
- filebeat-*
Severity: low
Risk score: 21
Runs every: 10 minutes
Searches indices from: now-60m (Date Math format, see also Additional look-back time
)
Maximum alerts per execution: 100
References:
Tags:
- AWS
- Elastic
- SecOps
- Monitoring
- Continuous Monitoring
Version: 1
Added (Elastic Stack release): 7.9.0
Rule authors: Elastic
Rule license: Elastic License
Potential false positives
editA resource group may be deleted by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Resource group deletions from unfamiliar users or hosts should be investigated. If a known behavior is causing false positives, it can be excluded from the rule.
Investigation guide
editThe AWS Filebeat module must be enabled to use this rule.
Rule query
editevent.action:DeleteGroup and event.dataset:aws.cloudtrail and event.provider:iam.amazonaws.com and event.outcome:success
Threat mapping
editFramework: MITRE ATT&CKTM
-
Tactic:
- Name: Impact
- ID: TA0040
- Reference URL: https://attack.mitre.org/tactics/TA0040/
-
Technique:
- Name: Account Access Removal
- ID: T1531
- Reference URL: https://attack.mitre.org/techniques/T1531/
ElasticON events are back!
Learn about the Elastic Search AI Platform from the experts at our live events.
Register now