Elastic medium stable kql

AWS WAF Rule or Rule Group Deletion

Identifies the deletion of an AWS Web Application Firewall (WAF) rule or rule group. WAF rules and rule groups enforce critical protections for web applications by filtering malicious HTTP requests, blocking known attack patterns, and enforcing access controls. Deleting these rules—even briefly—can expose applications to SQL injection, cross-site scripting, credential-stuffing bots, or targeted exploitation. Adversaries who have gained sufficient permissions may remove WAF protections as part of a broader defense evasion or impact strategy, often preceding data theft or direct application compromise.

View Source

Detection Logic

data_stream.dataset: aws.cloudtrail 
    and event.provider: (waf.amazonaws.com or waf-regional.amazonaws.com or wafv2.amazonaws.com) 
    and event.action: (DeleteRule or DeleteRuleGroup) 
    and event.outcome: success
    and not user_agent.original: (*Terraform* or *Pulumi*)

False Positives

⚠ Routine WAF maintenance, rule lifecycle updates, or temporary rule removals during application changes may trigger this alert. Validate whether the principal, source IP, automation role, or deployment pipeline is expected to modify WAF rules. Confirm that the deletion corresponds to a documented change or deployment before taking action.

Field Validations

Loading…

Comments (0)

Loading comments...