Name:AWS Defense Evasion Impair Security Services id:b28c4957-96a6-47e0-a965-6c767aac1458 version:8 date:2025-05-22 author:Bhavin Patel, Gowthamaraj Rajendran, Splunk status:production type:TTP Description:The following analytic detects attempts to delete critical AWS security service configurations, such as CloudWatch alarms, GuardDuty detectors, and Web Application Firewall rules. It leverages CloudTrail logs to identify specific API calls like "DeleteLogStream" and "DeleteDetector." This activity is significant because it indicates potential efforts to disable security monitoring and evade detection. If confirmed malicious, this could allow attackers to operate undetected, escalate privileges, or exfiltrate data without triggering security alerts, severely compromising the security posture of the AWS environment. Data_source:
-AWS CloudTrail DeleteLogStream
-AWS CloudTrail DeleteDetector
-AWS CloudTrail DeleteIPSet
-AWS CloudTrail DeleteWebACL
-AWS CloudTrail DeleteRule
-AWS CloudTrail DeleteRuleGroup
-AWS CloudTrail DeleteLoggingConfiguration
-AWS CloudTrail DeleteAlarms
search:`cloudtrail` eventName IN ("DeleteLogStream","DeleteDetector","DeleteIPSet","DeleteWebACL","DeleteRule","DeleteRuleGroup","DeleteLoggingConfiguration","DeleteAlarms") | rename user_name as user | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `aws_defense_evasion_impair_security_services_filter`
how_to_implement:You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment. known_false_positives:While this search has no known false positives, it is possible that it is a legitimate admin activity. Please consider filtering out these noisy events using userAgent, user_arn field names. References: -https://docs.aws.amazon.com/cli/latest/reference/guardduty/index.html -https://docs.aws.amazon.com/cli/latest/reference/waf/index.html -https://www.elastic.co/guide/en/security/current/prebuilt-rules.html drilldown_searches: name:'View the detection results for - "$user$"' search:'%original_detection_search% | search user = "$user$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$user$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' tags: analytic_story: - 'AWS Defense Evasion' asset_type:AWS Account mitre_attack_id: - 'T1562.008' product: - 'Splunk Enterprise' - 'Splunk Enterprise Security' - 'Splunk Cloud' security_domain:threat
