Title:
New Network Route Added
Status:
test
Description:Detects the addition of a new network route to a route table in AWS.
References:
-https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/
Author: jamesc-grafana
Date: 2024-07-11
modified:None
Tags:
- -'attack.defense-impairment'
- -'attack.t1686.001'
Logsource:
- product: aws
- service: cloudtrail
Detection:
selection:
eventSource:
'ec2.amazonaws.com'
eventName:
'CreateRoute'
condition:
selection
Falsepositives:
-New VPC Creation requiring setup of a new route table
-New subnets added requiring routing setup
Level:
medium
