Elastic high stable kql

AWS Configuration Recorder Stopped

Identifies when an AWS Config configuration recorder is stopped. AWS Config recorders continuously track and record configuration changes across supported AWS resources. Stopping the recorder immediately reduces visibility into infrastructure changes and can be abused by adversaries to evade detection, obscure follow-on activity, or weaken compliance and security monitoring controls.

View Source

Detection Logic

data_stream.dataset: aws.cloudtrail 
    and event.provider: config.amazonaws.com 
    and event.action: StopConfigurationRecorder 
    and event.outcome: success

False Positives

  • ⚠ Authorized administrators may temporarily stop the AWS Config recorder during planned maintenance, account restructuring, or controlled configuration changes. Automated infrastructure or compliance tooling may also stop and restart the recorder as part of setup or teardown workflows. Activity outside of documented change windows or from unexpected identities should be investigated.

Field Validations

Loading…

Comments (0)

Loading comments...