AWS WAF Web ACL Deletion Defense Evasion

Adversaries with compromised administrative credentials may target AWS Web Application Firewall (WAF) configurations as a means of defense evasion. By deleting a Web ACL, an attacker removes the security policies, rule groups, and logging configurations protecting critical cloud resources such as CloudFront distributions, Application Load Balancers, API Gateways, and AppSync APIs. This action effectively disables traffic inspection, exposing the application to direct exploitation, data theft, or resource abuse without triggering traditional application-layer alerts.

This activity is rarely performed manually outside of planned maintenance or automated infrastructure pipelines, making unexpected deletions a significant indicator of potential compromise. Security teams should monitor for unauthorized 'DeleteWebACL' events, particularly when initiated by identities that do not typically manage WAF infrastructure or through unusual toolsets.

Impact

Successful deletion of a Web ACL leaves the associated application entry points entirely unprotected by WAF rules, enabling unauthenticated attackers to probe for vulnerabilities, perform credential stuffing, or exploit application-layer weaknesses. If not detected and remediated immediately, this can lead to data exfiltration, service disruption, or complete system compromise, depending on the sensitivity of the exposed backend services.

Recommendation

• Deploy the Sigma rule provided in this brief to detect unauthorized 'DeleteWebACL' API calls in AWS CloudTrail logs.
• Restrict the IAM permission 'waf:DeleteWebACL' and 'wafv2:DeleteWebACL' to a minimal set of highly trusted roles or service accounts.
• Implement Multi-Factor Authentication (MFA) for all administrative identities with permissions to modify WAF resources.
• Integrate AWS Config or Security Hub to alert on modifications to WAF Web ACLs that bypass standard IaC deployment workflows.
• Baseline 'user_agent' strings and source IP addresses associated with infrastructure-as-code (IaC) tools like Terraform or Pulumi to differentiate automated updates from manual malicious activity.