Attack Chain

1. An attacker gains unauthorized access to an AWS account, potentially through compromised credentials or privilege escalation.
2. The attacker enumerates existing CloudWatch Log Groups to identify targets for deletion.
3. The attacker issues a 'DeleteLogGroup' API call using the AWS CLI, SDK, or console.
4. The CloudWatch service authenticates and authorizes the request based on the attacker's IAM permissions.
5. If authorized, the specified Log Group, including all associated log streams and historical log data, is permanently deleted.
6. The deletion event is recorded in CloudTrail logs.
7. Security monitoring pipelines and alerting mechanisms dependent on the deleted log group cease to function.
8. The attacker's malicious activity within the environment becomes more difficult to detect and investigate due to the absence of logs.

Impact

Deletion of CloudWatch Log Groups can severely impair an organization's security posture. The loss of historical log data can hinder forensic investigations and make it difficult to reconstruct attack timelines. Disruption of security monitoring pipelines can lead to delayed detection of ongoing threats. Affected sectors include any organization leveraging AWS for its infrastructure and security logging, with victim counts dependent on the scope of the compromised AWS accounts. The risk score is 47.

Recommendation

• Deploy the Sigma rule "AWS CloudWatch Log Group Deletion" to your SIEM and tune for your environment to detect unauthorized deletions of CloudWatch log groups.
• Investigate any alerts generated by the "AWS CloudWatch Log Group Deletion" rule, focusing on the source IP and user agent (source.ip, user_agent.original) to determine if the deletion was legitimate.
• Enforce least privilege on logs:DeleteLogGroup to restrict which IAM identities can delete log groups.
• Configure AWS Config rules to alert on missing or modified log groups to ensure that deletions are detected and investigated promptly.