Conversation
bryans3c
requested review from
Aegrah,
Samirbous,
django-88,
eric-forte-elastic,
imays11,
shashank-elastic,
terrancedejesus and
w0rk3r
September 15, 2026 07:32
|
⛔️ Test failed Results
|
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Five unresolved findings remain covering taxonomy, action coverage, retention matching, exclusions, and service tags.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Adds a cross-platform Elastic Defend KQL rule detecting AWS CLI tampering with audit and security services.
Changes:
- Detects disabling, deletion, and modification across multiple AWS security services.
- Adds endpoint setup guidance, metadata, tags, ATT&CK mappings, and references.
File summaries
| File | Summary and review findings |
|---|---|
rules/cross-platform/defense_evasion_aws_audit_and_security_service_tampering_via_cli.toml |
Adds the AWS CLI tampering rule. Findings remain for rule-type taxonomy (nit, 3 votes), event-action coverage (moderate, 2 votes), retention matching (moderate, 2 votes), command exclusion scope (moderate, 3 votes), and service tags (nit, 1 vote). |
Review details
Suppressed comments (1)
rules/cross-platform/defense_evasion_aws_audit_and_security_service_tampering_via_cli.toml:72
- The only service tag is
Service: AWS GuardDuty, but this rule also matches CloudTrail, Config, Security Hub, S3, CloudWatch Logs, Access Analyzer, Macie, Inspector, and Detective operations. This makes service-based filtering misleading; add canonical service tags for the other covered services or remove the GuardDuty-only tag.
"Service: AWS GuardDuty",
- Files reviewed: 1/1 changed files
- Comments generated: 4
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| type = "query" | ||
|
|
||
| query = ''' | ||
| event.category : "process" and event.type : "start" and event.action : (start or exec) and |
| *detective delete-graph* or | ||
| *logs delete-log-group* or | ||
| *logs delete-log-stream* or | ||
| *logs put-retention-policy*--retention-in-days 1* or |
| *logs put-retention-policy*--retention-in-days 1* or | ||
| *s3api delete-bucket-policy* or | ||
| *s3api put-bucket-logging* | ||
| ) and not process.command_line : (*--dry-run* or *help* or *--version* or *describe* or *list-* or *get-*) |
|
⛔️ Test failed Results
|
|
⛔️ Test failed Results
|
|
⛔️ Test failed Results
|
|
⛔️ Test failed Results
|
| *inspector2 disable* or | ||
| *logs delete-log-group* or | ||
| *logs delete-log-stream* or | ||
| *logs put-retention-policy*--retention-in-days 1* or |
Contributor
There was a problem hiding this comment.
This would miss --retention-in-days=1 and --retention-in-days 0 is that intentional?
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull Request
Issue link(s):
Summary - What I changed
Added
defense_evasion_aws_audit_and_security_service_tampering_via_cli, a process rule that fires when the AWS CLI is used to disable, delete, or blind the following AWS audit and security services: CloudTrail (stop-logging, delete-trail, delete-event-data-store, put-event-selectors, update-trail narrowing), GuardDuty (delete-detector, update-detector --no-enable, create-filter, delete-publishing-destination), AWS Config (stop-configuration-recorder, delete-configuration-recorder, delete-delivery-channel), Security Hub (disable-security-hub, batch-disable-standards), Access Analyzer (delete-analyzer), Macie (disable-macie), Inspector (disable), Detective (delete-graph), CloudWatch Logs (delete-log-group, delete-log-stream, put-retention-policy --retention-in-days 1), and S3 audit infrastructure (delete-bucket-policy, put-bucket-logging).Why it matters
Disabling CloudTrail and GuardDuty is the first step in nearly every documented cloud intrusion playbook. SCARLETEEL disabled CloudTrail before exfiltrating Terraform state and credentials. The Datadog Cloud Security Atlas records CloudTrail disabling as the most common defense-evasion step in post-exploitation. Because the rule fires on the endpoint before the AWS API call completes, it detects the tampering even when the adversary's goal is to suppress the very CloudTrail event that would record it.
How To Test
Checklist
Rule: New Rulequeryis inclusive, not overly exclusivenameanddescriptionare descriptive and free of typospython -m endpoint_rules ci verify-tuning-outcome --pr-number N