MATCH-S00678.md

Rules: AWS Route 53 Traffic Policy Creation

Description

Detects the AWS Route 53 CreateTrafficPolicy and CreateTrafficPolicyInstance API actions. These actions are used to create DNS resource record sets for domain or subdomain names.

Additional Details

Detail	Value
Type	Templated Match
Category	Defense Evasion
Apply Risk to Entities	device_ip, user_username, srcDevice_ip, device_hostname, srcDevice_hostname
Signal Name	AWS Route 53 Traffic Policy Creation
Summary Expression	{{action}} performed by user: {{user_username}}
Score/Severity	Static: 3
Enabled by Default	True
Prototype	False
Tags	_mitreAttackTactic:TA0042, _mitreAttackTechnique:T1584, _mitreAttackTechnique:T1584.002

Vendors and Products

• Amazon AWS - CloudTrail

Fields Used

Origin	Field
Normalized Schema	action
Normalized Schema	application
Normalized Schema	device_hostname
Normalized Schema	device_ip
Normalized Schema	listMatches
Normalized Schema	metadata_product
Normalized Schema	metadata_vendor
Normalized Schema	srcDevice_hostname
Normalized Schema	srcDevice_ip
Normalized Schema	user_username