Detectionmediumtest

New Network Route Added

Detects the addition of a new network route to a route table in AWS.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

jamesc-grafanaCreated Thu Jul 11c803b2ce-c4a2-4836-beae-b112010390b1cloud

Log Source

AWScloudtrail

ProductAWS← raw: aws

Servicecloudtrail← raw: cloudtrail

Detection Logic

detection:
    selection:
        eventSource: 'ec2.amazonaws.com'
        eventName: 'CreateRoute'
    condition: selection

False Positives

New VPC Creation requiring setup of a new route table

New subnets added requiring routing setup

References

MITRE ATT&CK

Tactics

Sub-techniques

Rule Metadata

Rule ID

c803b2ce-c4a2-4836-beae-b112010390b1

Status

test

Level

medium

Type

Detection

Created

Thu Jul 11

Author

Path

rules/cloud/aws/cloudtrail/aws_cloudtrail_new_route_added.yml

Raw Tags

attack.defense-evasionattack.t1562.007