Log-Deletion - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/log-deletion/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 12:00:00 +0000AWS CloudWatch Log Stream Deletionhttps://feed.craftedsignal.io/briefs/2024-01-cloudwatch-log-deletion/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-cloudwatch-log-deletion/Detection of Amazon CloudWatch log stream deletion via the 'DeleteLogStream' API, potentially indicating defense evasion or impact by adversaries aiming to conceal activity and disrupt security monitoring.This rule detects the deletion of an Amazon CloudWatch log stream using the "DeleteLogStream" API. CloudWatch log streams contain sequential log events crucial for monitoring applications, services, and AWS resources. Adversaries may delete these streams to cover their tracks after unauthorized actions, break ingestion pipelines feeding SIEM, alerting, or anomaly detection, or remove evidence before escalating privileges or moving laterally. This activity directly impacts security visibility, audit trails, and forensic evidence. The rule specifically looks for successful invocations of the DeleteLogStream API as recorded in CloudTrail logs, helping defenders identify potentially malicious actions within their AWS environment.

Attack Chain

  1. An attacker gains unauthorized access to an AWS account, potentially through compromised credentials or exploiting a vulnerability.
  2. The attacker enumerates available CloudWatch log streams to identify targets for deletion.
  3. The attacker invokes the DeleteLogStream API via the AWS CLI, SDK, or console.
  4. The DeleteLogStream API call is authenticated and authorized by AWS IAM.
  5. CloudWatch permanently deletes the specified log stream, removing all associated log events.
  6. The deletion event is recorded in AWS CloudTrail.
  7. The attacker attempts to cover their tracks by deleting related CloudTrail logs (though this action would generate further alerts).
  8. The attacker continues lateral movement or completes their objective, relying on the reduced visibility to remain undetected.

Impact

Successful deletion of CloudWatch log streams can severely impair an organization's ability to detect and respond to security incidents. Deleted log events are permanently removed, disrupting security visibility and breaking audit trails. The number of victims can range from single applications to entire AWS environments, depending on the scope of the attacker's access and the importance of the deleted log streams. This activity is particularly damaging in sectors heavily reliant on compliance and regulatory oversight.

Recommendation

  • Deploy the provided Sigma rule to your SIEM to detect instances of DeleteLogStream API calls in CloudTrail logs, and tune it for your environment.
  • Investigate alerts generated by the Sigma rule, focusing on the aws.cloudtrail.user_identity.arn and source.ip fields to identify the actor and origin of the request.
  • Implement IAM least-privilege principles for the logs:DeleteLogStream permission to minimize the blast radius of compromised accounts.
  • Enable AWS Config rules to monitor CloudWatch Logs configuration changes, providing an additional layer of defense against unauthorized deletions.
  • Establish guardrails using Service Control Policies (SCPs) to restrict log deletions to designated automation roles, preventing manual or accidental deletions from other accounts.
  • Review CloudTrail and Config timelines for preceding suspicious events correlated to the IP address * observed making the deletion.
]]>mediumadvisoryawscloudwatchlog-deletiondefense-evasion