Product
medium
advisory
Suspicious High-Volume CloudWatch Logs Read Operations
1 rule 1 TTPDetection of anomalous Amazon CloudWatch Logs activity characterized by high-volume API requests, which may indicate automated discovery or exfiltration of sensitive telemetry data.
CloudWatch Logs
cloud-security
data-exfiltration
aws
1r
1t
high
advisory
AWS Security Services Impairment via Deletion of Resources
2 rules 1 TTPDetection of adversaries attempting to impair or disable AWS security services by deleting resources across GuardDuty, AWS WAF, CloudWatch, Route 53, and CloudWatch Logs to evade detection and remove visibility.
CloudWatch +5
aws
cloudtrail
defense-evasion
cloud
2r
1t
medium
advisory
AWS CloudWatch Log Stream Deletion
2 rules 3 TTPsDetection of Amazon CloudWatch log stream deletion via the 'DeleteLogStream' API, potentially indicating defense evasion or impact by adversaries aiming to conceal activity and disrupt security monitoring.
CloudWatch Logs
aws
cloudwatch
log-deletion
defense-evasion
2r
3t