Product
Detection of Unauthorized Amazon CloudWatch Log Stream Deletion
1 rule 2 TTPsAdversaries may invoke the DeleteLogStream API to permanently destroy log data, impairing security monitoring and concealing malicious activity during post-exploitation.
AWS Security Services Impairment via Deletion of Resources
2 rules 1 TTPDetection of adversaries attempting to impair or disable AWS security services by deleting resources across GuardDuty, AWS WAF, CloudWatch, Route 53, and CloudWatch Logs to evade detection and remove visibility.
AWS Security Services Configuration Deletion
2 rules 1 TTPDetection of deletion of critical AWS Security Services configurations like CloudWatch alarms, GuardDuty detectors, and Web Application Firewall rules to evade detection, potentially leading to data breaches and unauthorized access.
AWS CloudWatch Alarm Deletion for Defense Evasion
2 rules 2 TTPsSuccessful deletion of Amazon CloudWatch alarms via the `DeleteAlarms` API, potentially indicating an adversary attempting to impair visibility, silence alerts, and evade detection after malicious activity within an AWS environment.