Name:AWS Defense Evasion Impair Security Services id:b28c4957-96a6-47e0-a965-6c767aac1458 version:9 date:2025-08-26 author:Bhavin Patel, Gowthamaraj Rajendran, Splunk, PashFW, Github Community status:production type:TTP Description:The following analytic detects attempts to impair or disable AWS security services by monitoring specific deletion operations across GuardDuty, AWS WAF (classic and v2), CloudWatch, Route 53, and CloudWatch Logs. These actions include deleting detectors, rule groups, IP sets, web ACLs, logging configurations, alarms, and log streams. Adversaries may perform such operations to evade detection or remove visibility from defenders. By explicitly pairing eventName values with their corresponding eventSource services, this detection reduces noise and ensures that only security-related deletions are flagged. It leverages CloudTrail logs to identify specific API calls like "DeleteLogStream" and "DeleteDetector." This activity is significant because it indicates potential efforts to disable security monitoring and evade detection. If confirmed malicious, this could allow attackers to operate undetected, escalate privileges, or exfiltrate data without triggering security alerts, severely compromising the security posture of the AWS environment. Data_source:
-AWS CloudTrail DeleteLogStream
-AWS CloudTrail DeleteDetector
-AWS CloudTrail DeleteIPSet
-AWS CloudTrail DeleteWebACL
-AWS CloudTrail DeleteRule
-AWS CloudTrail DeleteRuleGroup
-AWS CloudTrail DeleteLoggingConfiguration
-AWS CloudTrail DeleteAlarms
search:`cloudtrail` (eventName="DeleteDetector" AND eventSource="guardduty.amazonaws.com") OR ( eventName IN ("DeleteIPSet", "DeleteWebACL", "DeleteRuleGroup", "DeleteRule") AND eventSource IN ("guardduty.amazonaws.com", "wafv2.amazonaws.com", "waf.amazonaws.com") ) OR ( eventName="DeleteLoggingConfiguration" AND eventSource IN ("wafv2.amazonaws.com", "waf.amazonaws.com", "route53.amazonaws.com") ) | rename user_name as user | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_defense_evasion_impair_security_services_filter`
how_to_implement:You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment. known_false_positives:Legitimate administrators may occasionally delete GuardDuty detectors, WAF rule groups, or CloudWatch alarms during environment reconfiguration, migration, or decommissioning activities. In such cases, these events are expected and benign. These should be validated against approved change tickets or deployment pipelines to differentiate malicious activity from normal operations. Please consider filtering out these noisy events using userAgent, user_arn field names. References: -https://docs.aws.amazon.com/cli/latest/reference/guardduty/index.html -https://docs.aws.amazon.com/cli/latest/reference/waf/index.html -https://www.elastic.co/guide/en/security/current/prebuilt-rules.html drilldown_searches: name:'View the detection results for - "$user$"' search:'%original_detection_search% | search user = "$user$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$user$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' tags: analytic_story: - 'AWS Defense Evasion' asset_type:AWS Account mitre_attack_id: - 'T1562.008' product: - 'Splunk Enterprise' - 'Splunk Enterprise Security' - 'Splunk Cloud' security_domain:threat
