LoFP / routine waf maintenance, rule lifecycle updates, or temporary rule removals during application changes may trigger this alert. validate whether the principal, source ip, automation role, or deployment pipeline is expected to modify waf rules. confirm that the deletion corresponds to a documented change or deployment before taking action.

Techniques

• T1562

Sample rules

AWS WAF Rule or Rule Group Deletion

• source: elastic
• technicques:
  • T1562

Description

Identifies the deletion of an AWS Web Application Firewall (WAF) rule or rule group. WAF rules and rule groups enforce critical protections for web applications by filtering malicious HTTP requests, blocking known attack patterns, and enforcing access controls. Deleting these rules—even briefly—can expose applications to SQL injection, cross-site scripting, credential-stuffing bots, or targeted exploitation. Adversaries who have gained sufficient permissions may remove WAF protections as part of a broader defense evasion or impact strategy, often preceding data theft or direct application compromise.

Detection logic

event.dataset: aws.cloudtrail 
    and event.provider: (waf.amazonaws.com or waf-regional.amazonaws.com or wafv2.amazonaws.com) 
    and event.action: (DeleteRule or DeleteRuleGroup) 
    and event.outcome: success