Elastic high stable kql

AWS VPC Flow Logs Deletion

Identifies the deletion of one or more flow logs in AWS Elastic Compute Cloud (EC2). An adversary may delete flow logs in an attempt to evade defenses.

View Source

Detection Logic

data_stream.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and event.action:DeleteFlowLogs and event.outcome:success
    and not user_agent.original: (*Terraform* or *Pulumi*)

False Positives

  • ⚠ Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Flow log deletions by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Field Validations

Loading…

Comments (0)

Loading comments...