{
  "name": "TheCloud.Events — cloud log evidence (AWS)",
  "versions": {
    "attack": "19",
    "navigator": "5.1.0",
    "layer": "4.5"
  },
  "domain": "enterprise-attack",
  "description": "Techniques scored by how many cloud audit events in the TheCloud.Events catalog (144 AWS events) produce log evidence for them. Each technique's links open the event pages with sample logs, analyst notes, and key fields. Generated from https://thecloud.events/.",
  "sorting": 0,
  "layout": {
    "layout": "side",
    "aggregateFunction": "max",
    "showID": true,
    "showName": true,
    "showAggregateScores": false,
    "countUnscored": false
  },
  "hideDisabled": false,
  "techniques": [
    {
      "techniqueID": "T1021",
      "score": 3,
      "color": "",
      "comment": "3 events in the catalog produce evidence for this technique: AWS EnableSerialConsoleAccess, AWS ResumeSession, AWS StartSession",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS EnableSerialConsoleAccess",
          "url": "https://thecloud.events/events/aws-enableserialconsoleaccess/"
        },
        {
          "label": "AWS ResumeSession",
          "url": "https://thecloud.events/events/aws-resumesession/"
        },
        {
          "label": "AWS StartSession",
          "url": "https://thecloud.events/events/aws-startsession/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1021.004",
      "score": 4,
      "color": "",
      "comment": "4 events in the catalog produce evidence for this technique: AWS CreateKeyPair, AWS ImportKeyPair, AWS SendSerialConsoleSSHPublicKey, AWS SendSSHPublicKey",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS CreateKeyPair",
          "url": "https://thecloud.events/events/aws-createkeypair/"
        },
        {
          "label": "AWS ImportKeyPair",
          "url": "https://thecloud.events/events/aws-importkeypair/"
        },
        {
          "label": "AWS SendSerialConsoleSSHPublicKey",
          "url": "https://thecloud.events/events/aws-sendserialconsolesshpublickey/"
        },
        {
          "label": "AWS SendSSHPublicKey",
          "url": "https://thecloud.events/events/aws-sendsshpublickey/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1048",
      "score": 1,
      "color": "",
      "comment": "1 event in the catalog produce evidence for this technique: AWS AuthorizeSecurityGroupEgress",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS AuthorizeSecurityGroupEgress",
          "url": "https://thecloud.events/events/aws-authorizesecuritygroupegress/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1053",
      "score": 1,
      "color": "",
      "comment": "1 event in the catalog produce evidence for this technique: AWS CreateAssociation",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS CreateAssociation",
          "url": "https://thecloud.events/events/aws-createassociation/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1059",
      "score": 9,
      "color": "",
      "comment": "9 events in the catalog produce evidence for this technique: AWS CreateStack, AWS Invoke, AWS ModifyInstanceAttribute, AWS ResumeSession, AWS SendCommand, AWS StartBuild, AWS StartSession, AWS UpdateFunctionCode20150331v2, AWS UpdateFunctionConfiguration20150331v2",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS CreateStack",
          "url": "https://thecloud.events/events/aws-createstack/"
        },
        {
          "label": "AWS Invoke",
          "url": "https://thecloud.events/events/aws-invoke/"
        },
        {
          "label": "AWS ModifyInstanceAttribute",
          "url": "https://thecloud.events/events/aws-modifyinstanceattribute/"
        },
        {
          "label": "AWS ResumeSession",
          "url": "https://thecloud.events/events/aws-resumesession/"
        },
        {
          "label": "AWS SendCommand",
          "url": "https://thecloud.events/events/aws-sendcommand/"
        },
        {
          "label": "AWS StartBuild",
          "url": "https://thecloud.events/events/aws-startbuild/"
        },
        {
          "label": "AWS StartSession",
          "url": "https://thecloud.events/events/aws-startsession/"
        },
        {
          "label": "AWS UpdateFunctionCode20150331v2",
          "url": "https://thecloud.events/events/aws-updatefunctioncode20150331v2/"
        },
        {
          "label": "AWS UpdateFunctionConfiguration20150331v2",
          "url": "https://thecloud.events/events/aws-updatefunctionconfiguration20150331v2/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1072",
      "score": 1,
      "color": "",
      "comment": "1 event in the catalog produce evidence for this technique: AWS CreateStack",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS CreateStack",
          "url": "https://thecloud.events/events/aws-createstack/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1078.004",
      "score": 9,
      "color": "",
      "comment": "9 events in the catalog produce evidence for this technique: AWS AddRoleToInstanceProfile, AWS AssumeRole, AWS AssumeRoleWithSAML, AWS AssumeRoleWithWebIdentity, AWS ConsoleLogin, AWS GetFederationToken, AWS GetSessionToken, AWS PassRole, AWS PasswordRecoveryRequested",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS AddRoleToInstanceProfile",
          "url": "https://thecloud.events/events/aws-addroletoinstanceprofile/"
        },
        {
          "label": "AWS AssumeRole",
          "url": "https://thecloud.events/events/aws-assumerole/"
        },
        {
          "label": "AWS AssumeRoleWithSAML",
          "url": "https://thecloud.events/events/aws-assumerolewithsaml/"
        },
        {
          "label": "AWS AssumeRoleWithWebIdentity",
          "url": "https://thecloud.events/events/aws-assumerolewithwebidentity/"
        },
        {
          "label": "AWS ConsoleLogin",
          "url": "https://thecloud.events/events/aws-consolelogin/"
        },
        {
          "label": "AWS GetFederationToken",
          "url": "https://thecloud.events/events/aws-getfederationtoken/"
        },
        {
          "label": "AWS GetSessionToken",
          "url": "https://thecloud.events/events/aws-getsessiontoken/"
        },
        {
          "label": "AWS PassRole",
          "url": "https://thecloud.events/events/aws-passrole/"
        },
        {
          "label": "AWS PasswordRecoveryRequested",
          "url": "https://thecloud.events/events/aws-passwordrecoveryrequested/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1098",
      "score": 25,
      "color": "",
      "comment": "25 events in the catalog produce evidence for this technique: AWS AddPermission20150331v2, AWS AddUserToGroup, AWS AssociateIamInstanceProfile, AWS AttachGroupPolicy, AWS AttachRolePolicy, AWS AttachUserPolicy, AWS ChangePassword, AWS CreateAccessEntry, AWS CreateDevEndpoint, AWS CreatePolicy, AWS CreatePolicyVersion, AWS CreateStack, AWS CreateUser, AWS CreateVirtualMFADevice, AWS PutGroupPolicy, AWS PutKeyPolicy, AWS PutRolePolicy, AWS PutUserPolicy, AWS ReplaceIamInstanceProfileAssociation, AWS SetDefaultPolicyVersion, AWS UpdateAccessKey, AWS UpdateAssumeRolePolicy, AWS UpdateDevEndpoint, AWS UpdateFunctionConfiguration20150331v2, AWS UpdateLoginProfile",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS AddPermission20150331v2",
          "url": "https://thecloud.events/events/aws-addpermission20150331v2/"
        },
        {
          "label": "AWS AddUserToGroup",
          "url": "https://thecloud.events/events/aws-addusertogroup/"
        },
        {
          "label": "AWS AssociateIamInstanceProfile",
          "url": "https://thecloud.events/events/aws-associateiaminstanceprofile/"
        },
        {
          "label": "AWS AttachGroupPolicy",
          "url": "https://thecloud.events/events/aws-attachgrouppolicy/"
        },
        {
          "label": "AWS AttachRolePolicy",
          "url": "https://thecloud.events/events/aws-attachrolepolicy/"
        },
        {
          "label": "AWS AttachUserPolicy",
          "url": "https://thecloud.events/events/aws-attachuserpolicy/"
        },
        {
          "label": "AWS ChangePassword",
          "url": "https://thecloud.events/events/aws-changepassword/"
        },
        {
          "label": "AWS CreateAccessEntry",
          "url": "https://thecloud.events/events/aws-createaccessentry/"
        },
        {
          "label": "AWS CreateDevEndpoint",
          "url": "https://thecloud.events/events/aws-createdevendpoint/"
        },
        {
          "label": "AWS CreatePolicy",
          "url": "https://thecloud.events/events/aws-createpolicy/"
        },
        {
          "label": "AWS CreatePolicyVersion",
          "url": "https://thecloud.events/events/aws-createpolicyversion/"
        },
        {
          "label": "AWS CreateStack",
          "url": "https://thecloud.events/events/aws-createstack/"
        },
        {
          "label": "AWS CreateUser",
          "url": "https://thecloud.events/events/aws-createuser/"
        },
        {
          "label": "AWS CreateVirtualMFADevice",
          "url": "https://thecloud.events/events/aws-createvirtualmfadevice/"
        },
        {
          "label": "AWS PutGroupPolicy",
          "url": "https://thecloud.events/events/aws-putgrouppolicy/"
        },
        {
          "label": "AWS PutKeyPolicy",
          "url": "https://thecloud.events/events/aws-putkeypolicy/"
        },
        {
          "label": "AWS PutRolePolicy",
          "url": "https://thecloud.events/events/aws-putrolepolicy/"
        },
        {
          "label": "AWS PutUserPolicy",
          "url": "https://thecloud.events/events/aws-putuserpolicy/"
        },
        {
          "label": "AWS ReplaceIamInstanceProfileAssociation",
          "url": "https://thecloud.events/events/aws-replaceiaminstanceprofileassociation/"
        },
        {
          "label": "AWS SetDefaultPolicyVersion",
          "url": "https://thecloud.events/events/aws-setdefaultpolicyversion/"
        },
        {
          "label": "AWS UpdateAccessKey",
          "url": "https://thecloud.events/events/aws-updateaccesskey/"
        },
        {
          "label": "AWS UpdateAssumeRolePolicy",
          "url": "https://thecloud.events/events/aws-updateassumerolepolicy/"
        },
        {
          "label": "AWS UpdateDevEndpoint",
          "url": "https://thecloud.events/events/aws-updatedevendpoint/"
        },
        {
          "label": "AWS UpdateFunctionConfiguration20150331v2",
          "url": "https://thecloud.events/events/aws-updatefunctionconfiguration20150331v2/"
        },
        {
          "label": "AWS UpdateLoginProfile",
          "url": "https://thecloud.events/events/aws-updateloginprofile/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1098.001",
      "score": 2,
      "color": "",
      "comment": "2 events in the catalog produce evidence for this technique: AWS CreateAccessKey, AWS CreateLoginProfile",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS CreateAccessKey",
          "url": "https://thecloud.events/events/aws-createaccesskey/"
        },
        {
          "label": "AWS CreateLoginProfile",
          "url": "https://thecloud.events/events/aws-createloginprofile/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1098.003",
      "score": 2,
      "color": "",
      "comment": "2 events in the catalog produce evidence for this technique: AWS CreateRole, AWS CreateServiceLinkedRole",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS CreateRole",
          "url": "https://thecloud.events/events/aws-createrole/"
        },
        {
          "label": "AWS CreateServiceLinkedRole",
          "url": "https://thecloud.events/events/aws-createservicelinkedrole/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1098.004",
      "score": 4,
      "color": "",
      "comment": "4 events in the catalog produce evidence for this technique: AWS CreateKeyPair, AWS ImportKeyPair, AWS SendSerialConsoleSSHPublicKey, AWS SendSSHPublicKey",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS CreateKeyPair",
          "url": "https://thecloud.events/events/aws-createkeypair/"
        },
        {
          "label": "AWS ImportKeyPair",
          "url": "https://thecloud.events/events/aws-importkeypair/"
        },
        {
          "label": "AWS SendSerialConsoleSSHPublicKey",
          "url": "https://thecloud.events/events/aws-sendserialconsolesshpublickey/"
        },
        {
          "label": "AWS SendSSHPublicKey",
          "url": "https://thecloud.events/events/aws-sendsshpublickey/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1136.003",
      "score": 2,
      "color": "",
      "comment": "2 events in the catalog produce evidence for this technique: AWS CreateAccount, AWS CreateUser",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS CreateAccount",
          "url": "https://thecloud.events/events/aws-createaccount/"
        },
        {
          "label": "AWS CreateUser",
          "url": "https://thecloud.events/events/aws-createuser/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1213.006",
      "score": 1,
      "color": "",
      "comment": "1 event in the catalog produce evidence for this technique: AWS ModifyDBInstance",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS ModifyDBInstance",
          "url": "https://thecloud.events/events/aws-modifydbinstance/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1484.002",
      "score": 3,
      "color": "",
      "comment": "3 events in the catalog produce evidence for this technique: AWS CreateOpenIDConnectProvider, AWS CreateSAMLProvider, AWS UpdateAssumeRolePolicy",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS CreateOpenIDConnectProvider",
          "url": "https://thecloud.events/events/aws-createopenidconnectprovider/"
        },
        {
          "label": "AWS CreateSAMLProvider",
          "url": "https://thecloud.events/events/aws-createsamlprovider/"
        },
        {
          "label": "AWS UpdateAssumeRolePolicy",
          "url": "https://thecloud.events/events/aws-updateassumerolepolicy/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1485",
      "score": 13,
      "color": "",
      "comment": "13 events in the catalog produce evidence for this technique: AWS DeleteBucket, AWS DeleteDBCluster, AWS DeleteDBInstance, AWS DeleteFileSystem, AWS DeleteGlobalCluster, AWS DeleteObject, AWS DeleteObjects, AWS DeleteSnapshot, AWS DeleteVolume, AWS PutBucketLifecycle, AWS PutBucketLifecycleConfiguration, AWS ScheduleKeyDeletion, AWS TerminateInstances",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS DeleteBucket",
          "url": "https://thecloud.events/events/aws-deletebucket/"
        },
        {
          "label": "AWS DeleteDBCluster",
          "url": "https://thecloud.events/events/aws-deletedbcluster/"
        },
        {
          "label": "AWS DeleteDBInstance",
          "url": "https://thecloud.events/events/aws-deletedbinstance/"
        },
        {
          "label": "AWS DeleteFileSystem",
          "url": "https://thecloud.events/events/aws-deletefilesystem/"
        },
        {
          "label": "AWS DeleteGlobalCluster",
          "url": "https://thecloud.events/events/aws-deleteglobalcluster/"
        },
        {
          "label": "AWS DeleteObject",
          "url": "https://thecloud.events/events/aws-deleteobject/"
        },
        {
          "label": "AWS DeleteObjects",
          "url": "https://thecloud.events/events/aws-deleteobjects/"
        },
        {
          "label": "AWS DeleteSnapshot",
          "url": "https://thecloud.events/events/aws-deletesnapshot/"
        },
        {
          "label": "AWS DeleteVolume",
          "url": "https://thecloud.events/events/aws-deletevolume/"
        },
        {
          "label": "AWS PutBucketLifecycle",
          "url": "https://thecloud.events/events/aws-putbucketlifecycle/"
        },
        {
          "label": "AWS PutBucketLifecycleConfiguration",
          "url": "https://thecloud.events/events/aws-putbucketlifecycleconfiguration/"
        },
        {
          "label": "AWS ScheduleKeyDeletion",
          "url": "https://thecloud.events/events/aws-schedulekeydeletion/"
        },
        {
          "label": "AWS TerminateInstances",
          "url": "https://thecloud.events/events/aws-terminateinstances/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1489",
      "score": 1,
      "color": "",
      "comment": "1 event in the catalog produce evidence for this technique: AWS DisableKey",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS DisableKey",
          "url": "https://thecloud.events/events/aws-disablekey/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1490",
      "score": 1,
      "color": "",
      "comment": "1 event in the catalog produce evidence for this technique: AWS PutBucketLifecycle",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS PutBucketLifecycle",
          "url": "https://thecloud.events/events/aws-putbucketlifecycle/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1525",
      "score": 1,
      "color": "",
      "comment": "1 event in the catalog produce evidence for this technique: AWS PutImage",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS PutImage",
          "url": "https://thecloud.events/events/aws-putimage/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1526",
      "score": 2,
      "color": "",
      "comment": "2 events in the catalog produce evidence for this technique: AWS GetParameters, AWS GetSecretValue",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS GetParameters",
          "url": "https://thecloud.events/events/aws-getparameters/"
        },
        {
          "label": "AWS GetSecretValue",
          "url": "https://thecloud.events/events/aws-getsecretvalue/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1528",
      "score": 3,
      "color": "",
      "comment": "3 events in the catalog produce evidence for this technique: AWS GetFederationToken, AWS GetSessionToken, AWS GetSigninToken",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS GetFederationToken",
          "url": "https://thecloud.events/events/aws-getfederationtoken/"
        },
        {
          "label": "AWS GetSessionToken",
          "url": "https://thecloud.events/events/aws-getsessiontoken/"
        },
        {
          "label": "AWS GetSigninToken",
          "url": "https://thecloud.events/events/aws-getsignintoken/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1530",
      "score": 17,
      "color": "",
      "comment": "17 events in the catalog produce evidence for this technique: AWS CopyObject, AWS CreateDBSnapshot, AWS CreateImage, AWS CreateInstanceExportTask, AWS CreateSnapshot, AWS DeleteBucketPolicy, AWS GetObject, AWS ModifyDBSnapshotAttribute, AWS ModifyImageAttribute, AWS ModifySnapshotAttribute, AWS PutBucketAcl, AWS PutBucketPolicy, AWS PutBucketPublicAccessBlock, AWS RestoreDBInstanceFromDBSnapshot, AWS SharedSnapshotCopyInitiated, AWS SharedSnapshotVolumeCreated, AWS StartExportTask",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS CopyObject",
          "url": "https://thecloud.events/events/aws-copyobject/"
        },
        {
          "label": "AWS CreateDBSnapshot",
          "url": "https://thecloud.events/events/aws-createdbsnapshot/"
        },
        {
          "label": "AWS CreateImage",
          "url": "https://thecloud.events/events/aws-createimage/"
        },
        {
          "label": "AWS CreateInstanceExportTask",
          "url": "https://thecloud.events/events/aws-createinstanceexporttask/"
        },
        {
          "label": "AWS CreateSnapshot",
          "url": "https://thecloud.events/events/aws-createsnapshot/"
        },
        {
          "label": "AWS DeleteBucketPolicy",
          "url": "https://thecloud.events/events/aws-deletebucketpolicy/"
        },
        {
          "label": "AWS GetObject",
          "url": "https://thecloud.events/events/aws-getobject/"
        },
        {
          "label": "AWS ModifyDBSnapshotAttribute",
          "url": "https://thecloud.events/events/aws-modifydbsnapshotattribute/"
        },
        {
          "label": "AWS ModifyImageAttribute",
          "url": "https://thecloud.events/events/aws-modifyimageattribute/"
        },
        {
          "label": "AWS ModifySnapshotAttribute",
          "url": "https://thecloud.events/events/aws-modifysnapshotattribute/"
        },
        {
          "label": "AWS PutBucketAcl",
          "url": "https://thecloud.events/events/aws-putbucketacl/"
        },
        {
          "label": "AWS PutBucketPolicy",
          "url": "https://thecloud.events/events/aws-putbucketpolicy/"
        },
        {
          "label": "AWS PutBucketPublicAccessBlock",
          "url": "https://thecloud.events/events/aws-putbucketpublicaccessblock/"
        },
        {
          "label": "AWS RestoreDBInstanceFromDBSnapshot",
          "url": "https://thecloud.events/events/aws-restoredbinstancefromdbsnapshot/"
        },
        {
          "label": "AWS SharedSnapshotCopyInitiated",
          "url": "https://thecloud.events/events/aws-sharedsnapshotcopyinitiated/"
        },
        {
          "label": "AWS SharedSnapshotVolumeCreated",
          "url": "https://thecloud.events/events/aws-sharedsnapshotvolumecreated/"
        },
        {
          "label": "AWS StartExportTask",
          "url": "https://thecloud.events/events/aws-startexporttask/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1531",
      "score": 6,
      "color": "",
      "comment": "6 events in the catalog produce evidence for this technique: AWS ChangePassword, AWS DeleteAccessKey, AWS DeleteLoginProfile, AWS DeleteUser, AWS RemoveUserFromGroup, AWS UpdateLoginProfile",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS ChangePassword",
          "url": "https://thecloud.events/events/aws-changepassword/"
        },
        {
          "label": "AWS DeleteAccessKey",
          "url": "https://thecloud.events/events/aws-deleteaccesskey/"
        },
        {
          "label": "AWS DeleteLoginProfile",
          "url": "https://thecloud.events/events/aws-deleteloginprofile/"
        },
        {
          "label": "AWS DeleteUser",
          "url": "https://thecloud.events/events/aws-deleteuser/"
        },
        {
          "label": "AWS RemoveUserFromGroup",
          "url": "https://thecloud.events/events/aws-removeuserfromgroup/"
        },
        {
          "label": "AWS UpdateLoginProfile",
          "url": "https://thecloud.events/events/aws-updateloginprofile/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1535",
      "score": 1,
      "color": "",
      "comment": "1 event in the catalog produce evidence for this technique: AWS EnableRegion",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS EnableRegion",
          "url": "https://thecloud.events/events/aws-enableregion/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1537",
      "score": 17,
      "color": "",
      "comment": "17 events in the catalog produce evidence for this technique: AWS CopyObject, AWS CreateDBSnapshot, AWS CreateImage, AWS CreateInstanceExportTask, AWS CreateSnapshot, AWS GetObject, AWS ModifyDBInstance, AWS ModifyDBSnapshotAttribute, AWS ModifyImageAttribute, AWS ModifySnapshotAttribute, AWS PutBucketAcl, AWS PutBucketPolicy, AWS PutBucketReplication, AWS RestoreDBInstanceFromDBSnapshot, AWS SharedSnapshotCopyInitiated, AWS SharedSnapshotVolumeCreated, AWS StartExportTask",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS CopyObject",
          "url": "https://thecloud.events/events/aws-copyobject/"
        },
        {
          "label": "AWS CreateDBSnapshot",
          "url": "https://thecloud.events/events/aws-createdbsnapshot/"
        },
        {
          "label": "AWS CreateImage",
          "url": "https://thecloud.events/events/aws-createimage/"
        },
        {
          "label": "AWS CreateInstanceExportTask",
          "url": "https://thecloud.events/events/aws-createinstanceexporttask/"
        },
        {
          "label": "AWS CreateSnapshot",
          "url": "https://thecloud.events/events/aws-createsnapshot/"
        },
        {
          "label": "AWS GetObject",
          "url": "https://thecloud.events/events/aws-getobject/"
        },
        {
          "label": "AWS ModifyDBInstance",
          "url": "https://thecloud.events/events/aws-modifydbinstance/"
        },
        {
          "label": "AWS ModifyDBSnapshotAttribute",
          "url": "https://thecloud.events/events/aws-modifydbsnapshotattribute/"
        },
        {
          "label": "AWS ModifyImageAttribute",
          "url": "https://thecloud.events/events/aws-modifyimageattribute/"
        },
        {
          "label": "AWS ModifySnapshotAttribute",
          "url": "https://thecloud.events/events/aws-modifysnapshotattribute/"
        },
        {
          "label": "AWS PutBucketAcl",
          "url": "https://thecloud.events/events/aws-putbucketacl/"
        },
        {
          "label": "AWS PutBucketPolicy",
          "url": "https://thecloud.events/events/aws-putbucketpolicy/"
        },
        {
          "label": "AWS PutBucketReplication",
          "url": "https://thecloud.events/events/aws-putbucketreplication/"
        },
        {
          "label": "AWS RestoreDBInstanceFromDBSnapshot",
          "url": "https://thecloud.events/events/aws-restoredbinstancefromdbsnapshot/"
        },
        {
          "label": "AWS SharedSnapshotCopyInitiated",
          "url": "https://thecloud.events/events/aws-sharedsnapshotcopyinitiated/"
        },
        {
          "label": "AWS SharedSnapshotVolumeCreated",
          "url": "https://thecloud.events/events/aws-sharedsnapshotvolumecreated/"
        },
        {
          "label": "AWS StartExportTask",
          "url": "https://thecloud.events/events/aws-startexporttask/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1546",
      "score": 4,
      "color": "",
      "comment": "4 events in the catalog produce evidence for this technique: AWS AddPermission20150331v2, AWS PutRule, AWS PutTargets, AWS UpdateFunctionCode20150331v2",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS AddPermission20150331v2",
          "url": "https://thecloud.events/events/aws-addpermission20150331v2/"
        },
        {
          "label": "AWS PutRule",
          "url": "https://thecloud.events/events/aws-putrule/"
        },
        {
          "label": "AWS PutTargets",
          "url": "https://thecloud.events/events/aws-puttargets/"
        },
        {
          "label": "AWS UpdateFunctionCode20150331v2",
          "url": "https://thecloud.events/events/aws-updatefunctioncode20150331v2/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1548",
      "score": 10,
      "color": "",
      "comment": "10 events in the catalog produce evidence for this technique: AWS AddRoleToInstanceProfile, AWS DeleteRolePermissionsBoundary, AWS DeleteRolePolicy, AWS DeleteUserPermissionsBoundary, AWS DeleteUserPolicy, AWS DetachRolePolicy, AWS DetachUserPolicy, AWS PassRole, AWS PutRolePermissionsBoundary, AWS PutUserPermissionsBoundary",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS AddRoleToInstanceProfile",
          "url": "https://thecloud.events/events/aws-addroletoinstanceprofile/"
        },
        {
          "label": "AWS DeleteRolePermissionsBoundary",
          "url": "https://thecloud.events/events/aws-deleterolepermissionsboundary/"
        },
        {
          "label": "AWS DeleteRolePolicy",
          "url": "https://thecloud.events/events/aws-deleterolepolicy/"
        },
        {
          "label": "AWS DeleteUserPermissionsBoundary",
          "url": "https://thecloud.events/events/aws-deleteuserpermissionsboundary/"
        },
        {
          "label": "AWS DeleteUserPolicy",
          "url": "https://thecloud.events/events/aws-deleteuserpolicy/"
        },
        {
          "label": "AWS DetachRolePolicy",
          "url": "https://thecloud.events/events/aws-detachrolepolicy/"
        },
        {
          "label": "AWS DetachUserPolicy",
          "url": "https://thecloud.events/events/aws-detachuserpolicy/"
        },
        {
          "label": "AWS PassRole",
          "url": "https://thecloud.events/events/aws-passrole/"
        },
        {
          "label": "AWS PutRolePermissionsBoundary",
          "url": "https://thecloud.events/events/aws-putrolepermissionsboundary/"
        },
        {
          "label": "AWS PutUserPermissionsBoundary",
          "url": "https://thecloud.events/events/aws-putuserpermissionsboundary/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1550.001",
      "score": 4,
      "color": "",
      "comment": "4 events in the catalog produce evidence for this technique: AWS AssumeRole, AWS AssumeRoleWithSAML, AWS AssumeRoleWithWebIdentity, AWS GetSigninToken",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS AssumeRole",
          "url": "https://thecloud.events/events/aws-assumerole/"
        },
        {
          "label": "AWS AssumeRoleWithSAML",
          "url": "https://thecloud.events/events/aws-assumerolewithsaml/"
        },
        {
          "label": "AWS AssumeRoleWithWebIdentity",
          "url": "https://thecloud.events/events/aws-assumerolewithwebidentity/"
        },
        {
          "label": "AWS GetSigninToken",
          "url": "https://thecloud.events/events/aws-getsignintoken/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1552",
      "score": 2,
      "color": "",
      "comment": "2 events in the catalog produce evidence for this technique: AWS GetAuthorizationToken, AWS GetPasswordData",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS GetAuthorizationToken",
          "url": "https://thecloud.events/events/aws-getauthorizationtoken/"
        },
        {
          "label": "AWS GetPasswordData",
          "url": "https://thecloud.events/events/aws-getpassworddata/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1555.006",
      "score": 2,
      "color": "",
      "comment": "2 events in the catalog produce evidence for this technique: AWS GetParameters, AWS GetSecretValue",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS GetParameters",
          "url": "https://thecloud.events/events/aws-getparameters/"
        },
        {
          "label": "AWS GetSecretValue",
          "url": "https://thecloud.events/events/aws-getsecretvalue/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1556",
      "score": 2,
      "color": "",
      "comment": "2 events in the catalog produce evidence for this technique: AWS CreateOpenIDConnectProvider, AWS CreateSAMLProvider",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS CreateOpenIDConnectProvider",
          "url": "https://thecloud.events/events/aws-createopenidconnectprovider/"
        },
        {
          "label": "AWS CreateSAMLProvider",
          "url": "https://thecloud.events/events/aws-createsamlprovider/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1556.006",
      "score": 2,
      "color": "",
      "comment": "2 events in the catalog produce evidence for this technique: AWS DeactivateMFADevice, AWS DeleteVirtualMFADevice",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS DeactivateMFADevice",
          "url": "https://thecloud.events/events/aws-deactivatemfadevice/"
        },
        {
          "label": "AWS DeleteVirtualMFADevice",
          "url": "https://thecloud.events/events/aws-deletevirtualmfadevice/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1578",
      "score": 1,
      "color": "",
      "comment": "1 event in the catalog produce evidence for this technique: AWS ModifyInstanceAttribute",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS ModifyInstanceAttribute",
          "url": "https://thecloud.events/events/aws-modifyinstanceattribute/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1648",
      "score": 1,
      "color": "",
      "comment": "1 event in the catalog produce evidence for this technique: AWS Invoke",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS Invoke",
          "url": "https://thecloud.events/events/aws-invoke/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1651",
      "score": 4,
      "color": "",
      "comment": "4 events in the catalog produce evidence for this technique: AWS CreateAssociation, AWS ResumeSession, AWS SendCommand, AWS StartSession",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS CreateAssociation",
          "url": "https://thecloud.events/events/aws-createassociation/"
        },
        {
          "label": "AWS ResumeSession",
          "url": "https://thecloud.events/events/aws-resumesession/"
        },
        {
          "label": "AWS SendCommand",
          "url": "https://thecloud.events/events/aws-sendcommand/"
        },
        {
          "label": "AWS StartSession",
          "url": "https://thecloud.events/events/aws-startsession/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1685",
      "score": 24,
      "color": "",
      "comment": "24 events in the catalog produce evidence for this technique: AWS ArchiveFindings, AWS CreateFilter, AWS CreateIPSet, AWS DeleteAlarms, AWS DeleteBucket, AWS DeleteConfigRule, AWS DeleteConfigurationRecorder, AWS DeleteDeliveryChannel, AWS DeleteDetector, AWS DeleteLoginProfile, AWS DeleteMembers, AWS DeleteRolePolicy, AWS DeleteUserPolicy, AWS DetachRolePolicy, AWS DetachUserPolicy, AWS DisassociateFromMasterAccount, AWS DisassociateMembers, AWS LeaveOrganization, AWS RemoveAccountFromOrganization, AWS ScheduleKeyDeletion, AWS StopConfigurationRecorder, AWS StopMonitoringMembers, AWS UpdateDetector, AWS UpdateIPSet",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS ArchiveFindings",
          "url": "https://thecloud.events/events/aws-archivefindings/"
        },
        {
          "label": "AWS CreateFilter",
          "url": "https://thecloud.events/events/aws-createfilter/"
        },
        {
          "label": "AWS CreateIPSet",
          "url": "https://thecloud.events/events/aws-createipset/"
        },
        {
          "label": "AWS DeleteAlarms",
          "url": "https://thecloud.events/events/aws-deletealarms/"
        },
        {
          "label": "AWS DeleteBucket",
          "url": "https://thecloud.events/events/aws-deletebucket/"
        },
        {
          "label": "AWS DeleteConfigRule",
          "url": "https://thecloud.events/events/aws-deleteconfigrule/"
        },
        {
          "label": "AWS DeleteConfigurationRecorder",
          "url": "https://thecloud.events/events/aws-deleteconfigurationrecorder/"
        },
        {
          "label": "AWS DeleteDeliveryChannel",
          "url": "https://thecloud.events/events/aws-deletedeliverychannel/"
        },
        {
          "label": "AWS DeleteDetector",
          "url": "https://thecloud.events/events/aws-deletedetector/"
        },
        {
          "label": "AWS DeleteLoginProfile",
          "url": "https://thecloud.events/events/aws-deleteloginprofile/"
        },
        {
          "label": "AWS DeleteMembers",
          "url": "https://thecloud.events/events/aws-deletemembers/"
        },
        {
          "label": "AWS DeleteRolePolicy",
          "url": "https://thecloud.events/events/aws-deleterolepolicy/"
        },
        {
          "label": "AWS DeleteUserPolicy",
          "url": "https://thecloud.events/events/aws-deleteuserpolicy/"
        },
        {
          "label": "AWS DetachRolePolicy",
          "url": "https://thecloud.events/events/aws-detachrolepolicy/"
        },
        {
          "label": "AWS DetachUserPolicy",
          "url": "https://thecloud.events/events/aws-detachuserpolicy/"
        },
        {
          "label": "AWS DisassociateFromMasterAccount",
          "url": "https://thecloud.events/events/aws-disassociatefrommasteraccount/"
        },
        {
          "label": "AWS DisassociateMembers",
          "url": "https://thecloud.events/events/aws-disassociatemembers/"
        },
        {
          "label": "AWS LeaveOrganization",
          "url": "https://thecloud.events/events/aws-leaveorganization/"
        },
        {
          "label": "AWS RemoveAccountFromOrganization",
          "url": "https://thecloud.events/events/aws-removeaccountfromorganization/"
        },
        {
          "label": "AWS ScheduleKeyDeletion",
          "url": "https://thecloud.events/events/aws-schedulekeydeletion/"
        },
        {
          "label": "AWS StopConfigurationRecorder",
          "url": "https://thecloud.events/events/aws-stopconfigurationrecorder/"
        },
        {
          "label": "AWS StopMonitoringMembers",
          "url": "https://thecloud.events/events/aws-stopmonitoringmembers/"
        },
        {
          "label": "AWS UpdateDetector",
          "url": "https://thecloud.events/events/aws-updatedetector/"
        },
        {
          "label": "AWS UpdateIPSet",
          "url": "https://thecloud.events/events/aws-updateipset/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1685.002",
      "score": 10,
      "color": "",
      "comment": "10 events in the catalog produce evidence for this technique: AWS DeleteEventDataStore, AWS DeleteFlowLogs, AWS DeleteLogGroup, AWS DeleteLogStream, AWS DeleteObjects, AWS DeleteTrail, AWS PutBucketLifecycleConfiguration, AWS PutEventSelectors, AWS StopLogging, AWS UpdateTrail",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS DeleteEventDataStore",
          "url": "https://thecloud.events/events/aws-deleteeventdatastore/"
        },
        {
          "label": "AWS DeleteFlowLogs",
          "url": "https://thecloud.events/events/aws-deleteflowlogs/"
        },
        {
          "label": "AWS DeleteLogGroup",
          "url": "https://thecloud.events/events/aws-deleteloggroup/"
        },
        {
          "label": "AWS DeleteLogStream",
          "url": "https://thecloud.events/events/aws-deletelogstream/"
        },
        {
          "label": "AWS DeleteObjects",
          "url": "https://thecloud.events/events/aws-deleteobjects/"
        },
        {
          "label": "AWS DeleteTrail",
          "url": "https://thecloud.events/events/aws-deletetrail/"
        },
        {
          "label": "AWS PutBucketLifecycleConfiguration",
          "url": "https://thecloud.events/events/aws-putbucketlifecycleconfiguration/"
        },
        {
          "label": "AWS PutEventSelectors",
          "url": "https://thecloud.events/events/aws-puteventselectors/"
        },
        {
          "label": "AWS StopLogging",
          "url": "https://thecloud.events/events/aws-stoplogging/"
        },
        {
          "label": "AWS UpdateTrail",
          "url": "https://thecloud.events/events/aws-updatetrail/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1686.001",
      "score": 8,
      "color": "",
      "comment": "8 events in the catalog produce evidence for this technique: AWS AuthorizeDBSecurityGroupIngress, AWS AuthorizeSecurityGroupEgress, AWS AuthorizeSecurityGroupIngress, AWS CreateNetworkAclEntry, AWS DeleteNetworkAcl, AWS DeleteNetworkAclEntry, AWS DeleteRuleGroup, AWS DeleteWebACL",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "AWS AuthorizeDBSecurityGroupIngress",
          "url": "https://thecloud.events/events/aws-authorizedbsecuritygroupingress/"
        },
        {
          "label": "AWS AuthorizeSecurityGroupEgress",
          "url": "https://thecloud.events/events/aws-authorizesecuritygroupegress/"
        },
        {
          "label": "AWS AuthorizeSecurityGroupIngress",
          "url": "https://thecloud.events/events/aws-authorizesecuritygroupingress/"
        },
        {
          "label": "AWS CreateNetworkAclEntry",
          "url": "https://thecloud.events/events/aws-createnetworkaclentry/"
        },
        {
          "label": "AWS DeleteNetworkAcl",
          "url": "https://thecloud.events/events/aws-deletenetworkacl/"
        },
        {
          "label": "AWS DeleteNetworkAclEntry",
          "url": "https://thecloud.events/events/aws-deletenetworkaclentry/"
        },
        {
          "label": "AWS DeleteRuleGroup",
          "url": "https://thecloud.events/events/aws-deleterulegroup/"
        },
        {
          "label": "AWS DeleteWebACL",
          "url": "https://thecloud.events/events/aws-deletewebacl/"
        }
      ],
      "showSubtechniques": false
    }
  ],
  "gradient": {
    "colors": [
      "#ffffff",
      "#5c6b73"
    ],
    "minValue": 0,
    "maxValue": 25
  },
  "legendItems": [
    {
      "label": "More catalog events produce evidence for this technique",
      "color": "#5c6b73"
    }
  ],
  "metadata": [
    {
      "name": "source",
      "value": "https://thecloud.events"
    },
    {
      "name": "scope",
      "value": "AWS"
    }
  ],
  "links": [
    {
      "label": "TheCloud.Events",
      "url": "https://thecloud.events/"
    }
  ],
  "showTacticRowBackground": false,
  "tacticRowBackground": "#dddddd",
  "selectTechniquesAcrossTactics": true,
  "selectSubtechniquesWithParent": false
}