AWS Security Hub Finding Evasion via Finding Updates and Deletions (CloudTrail)

Identifies Security Hub finding and insight modifications (update or delete) that may impair detection results.

FreeUnreviewedSigmahighv1

aws-security-hub-finding-evasion-via-finding-updates-and-deletions-cloudtrail-a607e1fe

title: AWS Security Hub Finding Evasion via Finding Updates and Deletions (CloudTrail)
id: 00475ea0-5c55-43f4-832b-852362df206a
status: stable
description: This rule flags AWS Security Hub events where findings or insights are modified through BatchUpdateFindings, UpdateFindings, UpdateInsight, DeleteInsight, and related operations. Adversaries may attempt to evade detection by impairing the integrity of Security Hub results. The detection relies on AWS CloudTrail records that include eventSource=securityhub.amazonaws.com and the specific eventName values corresponding to these changes.
references:
  - https://docs.aws.amazon.com/cli/latest/reference/securityhub/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_securityhub_finding_evasion.yml
author: Sittikorn S, Huntrule Team
date: 2021-06-28
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: securityhub.amazonaws.com
    eventName:
      - BatchUpdateFindings
      - DeleteInsight
      - UpdateFindings
      - UpdateInsight
  condition: selection
falsepositives:
  - System or Network administrator behaviors
  - DEV, UAT, SAT environment. You should apply this rule with PROD environment only.
level: high
license: DRL-1.1
related:
  - id: a607e1fe-74bf-4440-a3ec-b059b9103157
    type: derived

What it detects

This rule flags AWS Security Hub events where findings or insights are modified through BatchUpdateFindings, UpdateFindings, UpdateInsight, DeleteInsight, and related operations. Adversaries may attempt to evade detection by impairing the integrity of Security Hub results. The detection relies on AWS CloudTrail records that include eventSource=securityhub.amazonaws.com and the specific eventName values corresponding to these changes.

Known false positives

System or Network administrator behaviors
DEV, UAT, SAT environment. You should apply this rule with PROD environment only.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.