Name:AWS Defense Evasion Delete CloudWatch Log Group id:d308b0f1-edb7-4a62-a614-af321160710f version:12 date:None author:Gowthamaraj Rajendran, Splunk status:production type:TTP Description:The following analytic detects the deletion of CloudWatch log groups in AWS, identified through `DeleteLogGroup` events in CloudTrail logs. This detection leverages CloudTrail data to monitor for successful log group deletions, excluding console-based actions. This activity is significant as it indicates potential attempts to evade logging and monitoring, which is crucial for maintaining visibility into AWS activities. If confirmed malicious, this could allow attackers to hide their tracks, making it difficult to detect further malicious actions or investigate incidents within the compromised AWS environment. Data_source:
how_to_implement:You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment. known_false_positives:While this search has no known false positives, it is possible that an AWS admin has deleted CloudWatch logging. Please investigate this activity. References: -https://attack.mitre.org/techniques/T1562/008/ drilldown_searches: name:'View the detection results for - "$user$"' search:'%original_detection_search% | search user = "$user$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$user$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['AWS Defense Evasion']
