LoFP LoFP / t1562.008

t1562.008

TitleTags
administrators might alter features for troubleshooting, performance reasons, or other administrative tasks. filter as needed.
administrators might temporarily disable the advanced audit for troubleshooting, performance reasons, or other administrative tasks. filter as needed.
legitimate administrators may delete guardrails as part of normal operations, such as when replacing outdated guardrails with updated versions, cleaning up test resources, or consolidating security controls. consider implementing an allowlist for expected administrators who regularly manage guardrails configurations.
legitimate administrators may delete model invocation logging configurations during maintenance, when updating logging policies, or when cleaning up unused resources. consider implementing an allowlist for expected administrators who regularly manage logging configurations.
legitimate administrators may occasionally delete guardduty detectors, waf rule groups, or cloudwatch alarms during environment reconfiguration, migration, or decommissioning activities. in such cases, these events are expected and benign. these should be validated against approved change tickets or deployment pipelines to differentiate malicious activity from normal operations. please consider filtering out these noisy events using useragent, user_arn field names.
valid change in a trail
valid change in aws config service
while this search has no known false positives, it is possible that it is a legitimate admin activity. please consider filtering out these noisy events using useragent, user_arn field names.