saakov-aws-1

[saakovv]

Summary of the Pull Reques

Adds new AWS CloudTrail detection rules covering attack surfaces not yet represented in the Sigma ruleset. Rules were identified by gap analysis comparing the existing rules/cloud/aws/cloudtrail/ corpus against a production AWS environment monitoring

Coverage includes:

AWS Backup destruction - ransomware precursor pattern (vault/recovery point deletion)

Changelog:
new: AWS Backup Vault or Recovery Point Deleted

[github-actions]

Welcome 👋

It looks like this is your first pull request on the Sigma rules repository!

Please make sure to read the SigmaHQ conventions to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.

Thanks again, and welcome to the Sigma community! 😃

[saakovv]

[saakovv]

@swachchhanda000

Hi, based on all my PR based on #5998
Yes, I previously used Cloude to do everything quickly and centrally based on my alerts, now I will add each alert separately so that you can make sure that they are working))