AWS SQS PurgeQueue Defense Evasion

AWS SQS is a managed message queuing service utilized for decoupling distributed components and buffering event-driven data. Threat actors may exploit the PurgeQueue API call to execute destructive operations within a cloud environment. By purging a queue, an attacker permanently and irreversibly deletes all pending messages, which can result in operational disruption, loss of critical data, or the destruction of audit trails and security-relevant events buffered within the SQS queue. This behavior is primarily observed as a means to impair detection capabilities or impact business continuity. Security teams should monitor for unauthorized or anomalous execution of this command, particularly when performed by identities lacking clear operational requirements for queue management.

Impact

Successful execution of this action leads to the permanent loss of all message data contained within the targeted SQS queue. This can cause significant business logic failures in dependent downstream systems, gaps in security logging pipelines that rely on SQS for event ingestion, and the deletion of forensic evidence that would otherwise aid incident response efforts.

Recommendation

• Implement the detection rule below to alert on the 'PurgeQueue' event in AWS CloudTrail logs.
• Review IAM policies to ensure that the 'sqs:PurgeQueue' permission follows the principle of least privilege.
• Investigate the identity performing the purge by reviewing 'aws.cloudtrail.user_identity.arn' and correlating with other recent activity from the same access key.
• Establish a baseline of authorized maintenance and automated cleanup scripts to reduce noise from legitimate operational activities.
• Deploy the provided detection logic to your SIEM and tune against known automated operational jobs that legitimately utilize the PurgeQueue API.