AWS SecurityHub Findings Evasion

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•29

This rule detects attempts to modify or delete findings and insights within AWS SecurityHub. Adversaries may do this to evade detection by removing or altering security alerts generated by SecurityHub, thereby hindering defensive mechanisms and obscuring their activities. The rule specifically looks for 'BatchUpdateFindings', 'DeleteInsight', 'UpdateFindings', and 'UpdateInsight' events originating from 'securityhub.amazonaws.com'.