Possible AWS ElastiCache Security Group Modified or Deleted (via cloudtrail)

title: Possible AWS ElastiCache Security Group Modified or Deleted (via cloudtrail)
id: fe10c3bb-7c6f-5ee2-9e0b-d92f28d26f3b
status: stable
description: This rule detects when an ElastiCache security group has been modified or deleted.
references:
    - https://attack.mitre.org/techniques/T1531/
    - https://github.com/elastic/detection-rules/blob/7d5efd68603f42be5e125b5a6a503b2ef3ac0f4e/rules/integrations/aws/impact_elasticache_security_group_modified_or_deleted.toml
author: Huntrule Team
date: 2026-02-10
tags:
    - attack.impact
    - attack.t1531
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: elasticache.amazonaws.com
        eventName:
            - 'DeleteCacheSecurityGroup'
            - 'AuthorizeCacheSecurityGroupIngress'
            - 'RevokeCacheSecurityGroupIngress'
            - 'AuthorizeCacheSecurityGroupEgress'
            - 'RevokeCacheSecurityGroupEgress'
    condition: selection
falsepositives:
    - Unknown
level: low