AWS Defense Evasion Impair Security Services

Name:AWS Defense Evasion Impair Security Services
id:b28c4957-96a6-47e0-a965-6c767aac1458
version:6
date:2025-02-10
author:Bhavin Patel, Gowthamaraj Rajendran, Splunk
status:production
type:Hunting
Description:The following analytic detects attempts to delete critical AWS security service configurations, such as CloudWatch alarms, GuardDuty detectors, and Web Application Firewall rules. It leverages CloudTrail logs to identify specific API calls like "DeleteLogStream" and "DeleteDetector." This activity is significant because it indicates potential efforts to disable security monitoring and evade detection. If confirmed malicious, this could allow attackers to operate undetected, escalate privileges, or exfiltrate data without triggering security alerts, severely compromising the security posture of the AWS environment.
Data_source:

• -AWS CloudTrail DeleteLogStream
• -AWS CloudTrail DeleteDetector
• -AWS CloudTrail DeleteIPSet
• -AWS CloudTrail DeleteWebACL
• -AWS CloudTrail DeleteRule
• -AWS CloudTrail DeleteRuleGroup
• -AWS CloudTrail DeleteLoggingConfiguration
• -AWS CloudTrail DeleteAlarms

search:`cloudtrail` eventName IN ("DeleteLogStream","DeleteDetector","DeleteIPSet","DeleteWebACL","DeleteRule","DeleteRuleGroup","DeleteLoggingConfiguration","DeleteAlarms")
| rename user_name as user
| stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`| `aws_defense_evasion_impair_security_services_filter`

how_to_implement:You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment.
known_false_positives:While this search has no known false positives, it is possible that it is a legitimate admin activity. Please consider filtering out these noisy events using userAgent, user_arn field names.
References:
  -https://docs.aws.amazon.com/cli/latest/reference/guardduty/index.html
  -https://docs.aws.amazon.com/cli/latest/reference/waf/index.html
  -https://www.elastic.co/guide/en/security/current/prebuilt-rules.html
drilldown_searches:
  :
tags:
  analytic_story:
    - 'AWS Defense Evasion'
  asset_type:AWS Account
  mitre_attack_id:
    - 'T1562.008'
  product:
    - 'Splunk Enterprise'
    - 'Splunk Enterprise Security'
    - 'Splunk Cloud'
  security_domain:threat

tests:
 name:'True Positive Test'
 attack_data:
  data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/aws_delete_security_services/aws_cloudtrail_events.json
  sourcetype: aws:cloudtrail
  source: aws_cloudtrail
manual_test:None