Logpresso Store

AWS Configuration Recorder Stopped

Detect when a user stops an AWS Configuration Recorder

Stream Priority High aws-cloudtrail T1562.001

AWS Console External Login

User logs in to the AWS console from an external location.

Stream T1078.004

Terminate AWS EC2 Instance

AWS EC2 인스턴스 삭제 시 탐지합니다.

Stream Priority High aws-cloudtrail T1578.003

AWS IAM User Created

Detects when a user creates a new AWS IAM account.

Stream T1136.003

AWS Security Group Ingress Rule Allows Broad CIDR

Detects when a user adds an ingress rule to an AWS security group that allows inbound access from a Class B or larger IP range (/16 or less).

Stream T1562.007

AWS Security Group Open to the World

Detects when a user adds an ingress rule to an AWS security group that allows internet inbound access.

Stream T1562.007

Create AWS EC2 Instance

AWS EC2 인스턴스 생성 시 탐지합니다.

Stream Priority Low aws-cloudtrail T1578.002