ID | Technique | Tactic |
---|---|---|
T1562 | Impair Defenses | Defense Evasion |
T1562.008 | Disable or Modify Cloud Logs | Defense Evasion |
Detection: AWS Defense Evasion Delete CloudWatch Log Group
Description
The following analytic detects the deletion of CloudWatch log groups in AWS, identified through DeleteLogGroup
events in CloudTrail logs. This detection leverages CloudTrail data to monitor for successful log group deletions, excluding console-based actions. This activity is significant as it indicates potential attempts to evade logging and monitoring, which is crucial for maintaining visibility into AWS activities. If confirmed malicious, this could allow attackers to hide their tracks, making it difficult to detect further malicious actions or investigate incidents within the compromised AWS environment.
Search
1`cloudtrail` eventName = DeleteLogGroup eventSource = logs.amazonaws.com userAgent !=console.amazonaws.com errorCode = success
2| stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.logGroupName) as log_group_name by src region eventName userAgent user_arn aws_account_id
3| `security_content_ctime(firstTime)`
4| `security_content_ctime(lastTime)`
5| `aws_defense_evasion_delete_cloudwatch_log_group_filter`
Data Source
Name | Platform | Sourcetype | Source | Supported App |
---|---|---|---|---|
AWS CloudTrail DeleteLogGroup | AWS | 'aws:cloudtrail' |
'aws_cloudtrail' |
N/A |
Macros Used
Name | Value |
---|---|
cloudtrail | sourcetype=aws:cloudtrail |
aws_defense_evasion_delete_cloudwatch_log_group_filter | search * |
aws_defense_evasion_delete_cloudwatch_log_group_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Notable | Yes |
Rule Title | %name% |
Rule Description | %description% |
Notable Event Fields | user, dest |
Creates Risk Event | True |
Implementation
You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment.
Known False Positives
While this search has no known false positives, it is possible that an AWS admin has deleted CloudWatch logging. Please investigate this activity.
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message | Risk Score | Impact | Confidence |
---|---|---|---|
User $user_arn$ has deleted a CloudWatch logging group for account id $aws_account_id$ from IP $src$ | 90 | 100 | 90 |
References
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | aws_cloudtrail |
aws:cloudtrail |
Integration | ✅ Passing | Dataset | aws_cloudtrail |
aws:cloudtrail |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 2