Detection of AWS Route 53 Resolver Query Log Deletion

Adversaries targeting AWS environments may attempt to disable security monitoring by deleting Amazon Route 53 Resolver Query Log configurations. These logs provide critical visibility into DNS activity across VPCs, including queries initiated by EC2 instances, containerized workloads, and Lambda functions. By successfully invoking the DeleteResolverQueryLogConfig API call, an attacker immediately halts DNS logging, effectively creating a blind spot that hides evidence of command-and-control (C2) communication, lateral movement, and data exfiltration. This tactic is classified as a method of impairing defenses within cloud environments, forcing defenders to rely on fragmented telemetry when investigating unauthorized resource access or configuration tampering.

Attack Chain

1. Attacker gains initial access to an AWS account via compromised IAM credentials or a service role.
2. Attacker performs reconnaissance to identify enabled security logging configurations, specifically checking Route 53 Resolver Query Log settings.
3. Attacker evaluates existing IAM permissions to determine if the route53resolver:DeleteResolverQueryLogConfig action is authorized.
4. Attacker executes the DeleteResolverQueryLogConfig API call through the AWS CLI, SDK, or Console.
5. AWS CloudTrail logs the successful deletion event, while the Resolver service stops logging DNS traffic for the associated VPCs.
6. Attacker proceeds with malicious activity (e.g., C2 beaconing or data exfiltration) under the cover of the logging gap.
7. Defender loses visibility into DNS-based C2 indicators, delaying incident detection and response.

Impact

The deletion of query log configurations results in the immediate loss of visibility into DNS activity across one or more VPCs. This impairment hinders the ability to detect malicious domains or suspicious DNS query patterns, which are often the primary indicators of C2 and exfiltration in cloud-native attacks. If left undetected, this allows attackers to operate within the environment for extended periods without leaving logs for forensic analysis.

Recommendation

Prioritize the monitoring of logging-related API calls in your cloud environment to detect unauthorized tampering.

• Deploy the provided Sigma rule to alert on DeleteResolverQueryLogConfig events in your SIEM or logging platform.
• Audit existing IAM policies to ensure the route53resolver:DeleteResolverQueryLogConfig permission is granted only to highly privileged, authorized administrative roles.
• Implement AWS Service Control Policies (SCPs) or IAM boundary conditions to restrict the deletion of logging configurations to specific, trusted principal ARNs or network origins.
• Use AWS Config or Security Hub to monitor for non-compliance regarding the existence of active Resolver Query Log configurations on critical VPCs.