LoFP / during maintenance operations or testing, authorized administrators may delete vpc flow logs as part of routine network management or cleanup activities.

Sample rules

AWS VPC Flow Logs Deleted

• source: sigma
• technicques:

Description

Detects the deletion of one or more VPC Flow Logs in AWS Elastic Compute Cloud (EC2) through the DeleteFlowLogs API call. Adversaries may delete flow logs to evade detection or remove evidence of network activity, hindering forensic investigations and visibility into malicious operations.

Detection logic

condition: selection_event_name and 1 of selection_status_*
selection_event_name:
  eventName: DeleteFlowLogs
selection_status_null:
  errorCode: null
selection_status_success:
  errorCode: Success

AWS Bucket Deleted

• source: sigma
• technicques:

Description

Detects the deletion of S3 buckets in AWS CloudTrail logs. Monitoring the deletion of S3 buckets is critical for security and data integrity, as it may indicate potential data loss or unauthorized access attempts.

Detection logic

condition: selection_event_name and 1 of selection_status_*
selection_event_name:
  eventName: DeleteBucket
selection_status_null:
  errorCode: null
selection_status_success:
  errorCode: Success