Techniques
Sample rules
AWS Config Disabling Channel/Recorder
- source: sigma
- technicques:
- t1562
- t1562.001
Description
Detects AWS Config Service disabling
Detection logic
condition: selection
selection:
eventName:
- DeleteDeliveryChannel
- StopConfigurationRecorder
eventSource: config.amazonaws.com