Update rules/aws/impact_iam_deactivate_mfa_device.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
elastic · Apr 22, 2021 · 475a132 · 475a132
1 parent 178baaf
commit 475a132
Showing 1 changed file with 1 addition and 2 deletions.
diff --git a/rules/aws/impact_iam_deactivate_mfa_device.toml b/rules/aws/impact_iam_deactivate_mfa_device.toml
@@ -36,7 +36,7 @@ timestamp_override = "event.ingested"
 type = "query"
 
 query = '''
-event.action:(DeactivateMFADevice or DeleteVirtualMFADevice) and event.dataset:aws.cloudtrail and event.provider:iam.amazonaws.com and event.outcome:success
+event.dataset:aws.cloudtrail and event.provider:iam.amazonaws.com and event.action:(DeactivateMFADevice or DeleteVirtualMFADevice) and event.outcome:success
 '''
 
 
@@ -52,4 +52,3 @@ reference = "https://attack.mitre.org/techniques/T1531/"
 id = "TA0040"
 name = "Impact"
 reference = "https://attack.mitre.org/tactics/TA0040/"
-