Techniques
Sample rules
AWS Config Disabling Channel/Recorder
- source: sigma
- technicques:
- t1685
- t1685.002
Description
Detects AWS Config Service disabling
Detection logic
condition: selection
selection:
eventName:
- DeleteDeliveryChannel
- StopConfigurationRecorder
eventSource: config.amazonaws.com