Detection of Unauthorized AWS WAF Rule Deletion

The deletion of AWS WAF rules and rule groups represents a deliberate effort to impair an organization's defensive posture. By removing these protections, adversaries can bypass rate-limiting, access controls, and signature-based filtering for SQL injection, cross-site scripting (XSS), and credential-stuffing attacks. This behavior is often observed in the reconnaissance or pre-exploitation phase of a breach, where attackers attempt to erase defenses protecting high-value APIs or specific application endpoints.

Defenders should monitor AWS CloudTrail logs for DeleteRule or DeleteRuleGroup events originating from unexpected principals, sources, or automation tools. While some organizations utilize infrastructure-as-code (IaC) to manage WAF lifecycles, unauthorized deletions - especially those occurring outside of CI/CD windows - should be treated as high-priority security incidents. The scope of this threat is global across all AWS accounts utilizing WAF for web protection.

Impact

Successful unauthorized deletion of WAF rules leaves web applications exposed to direct exploitation. Observed consequences include the bypass of established security boundaries, enabling attackers to execute malicious payloads that were previously blocked, potentially leading to unauthorized data exfiltration, service disruption, or complete application compromise.

Recommendation

• Deploy the provided Sigma rule to detect unauthorized WAF API activity in CloudTrail logs.
• Establish a baseline for authorized WAF maintenance; monitor and alert on deletions that originate outside of established CI/CD service roles (e.g., Terraform or Pulumi).
• Implement service control policies (SCPs) or AWS Config rules to prevent the modification or deletion of WAF resources in production environments.
• Audit IAM permissions to ensure that the principle of least privilege is applied, specifically restricting waf:DeleteRule and waf:DeleteRuleGroup permissions to highly restricted administration roles.
• Integrate CloudTrail event analysis into incident response playbooks for immediate verification of WAF changes.