Elastic medium stable kql

AWS SQS Queue Purge

Identifies when an AWS Simple Queue Service (SQS) queue is purged. Purging an SQS queue permanently deletes all messages currently in the queue. Adversaries may use this action to disrupt application workflows, destroy operational data, or impair monitoring and alerting by removing messages that contain evidence of malicious activity.

View Source

Detection Logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "sqs.amazonaws.com"
    and event.action: "PurgeQueue"
    and event.outcome: "success"

False Positives

  • ⚠ Authorized administrators or automated workflows may purge SQS queues for legitimate operational reasons, such as clearing stale messages, resetting test environments, or performing approved maintenance. Verify that the action aligns with documented procedures and expected operational behavior.

Field Validations

Loading…

Comments (0)

Loading comments...