automated log analytics, siem pipelines, incident-response tooling, backup processes, and administrative troubleshooting may continuously read cloudwatch logs and generate a high volume of matching operations. the prevalence of this activity has not yet been evaluated against broader customer telemetry. review the principal, account, source addresses, user agents, regions, and accessed cloudwatch logs resources before escalating.

splunk

Techniques

Sample rules

AWS Repeated CloudWatch Logs Read Operations

source: splunk
technicques:

Description

The following analytic detects a high volume of Amazon CloudWatch Logs read operations performed by the same AWS principal and account within a five-minute period. It identifies more than 500 DescribeLogGroups, DescribeLogStreams, DownloadLogEvents, FilterLogEvents, GetLogEvents, or GetQueryResults API calls. This activity may indicate automated discovery or collection of operational, application, or security telemetry from CloudWatch Logs.

Detection logic

`cloudtrail`
eventSource="logs.amazonaws.com"
eventName IN (
    "DescribeLogGroups",
    "DescribeLogStreams",
    "DownloadLogEvents",
    "FilterLogEvents",
    "GetLogEvents",
    "GetQueryResults"
)


| eval user='userIdentity.principalId'

| eval vendor_account=coalesce(
    vendor_account,
    recipientAccountId,
    'userIdentity.accountId'
)

| eval role_name='userIdentity.sessionContext.sessionIssuer.userName'

| eval signature=coalesce(signature, eventName)

| eval src=coalesce(src, sourceIPAddress)

| eval user_agent=coalesce(user_agent, userAgent)

| eval vendor_region=coalesce(vendor_region, awsRegion)


| where isnotnull(user) AND len(trim(user)) > 0


| dedup eventID keepempty=true


| sort 0 _time


| streamstats time_window=5m count AS event_count
    by user vendor_account


| where event_count > 500


| stats max(_time) AS lastTime
        max(event_count) AS event_count
        min(_time) AS firstTime
        values(role_name) AS role_name
        values(signature) AS api_operations
        values(src) AS src
        values(user_agent) AS user_agent
        values(vendor_region) AS vendor_region
  by user vendor_account


| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `aws_repeated_cloudwatch_logs_read_operations_filter`