AWS CloudTrail Detects AWS Config Delivery Channel Deletion or Recorder Stopping

Identifies CloudTrail actions that delete AWS Config delivery channels or stop the configuration recorder.

FreeUnreviewedSigmahighv1

aws-cloudtrail-detects-aws-config-delivery-channel-deletion-or-recorder-stopping-07330162

title: AWS CloudTrail Detects AWS Config Delivery Channel Deletion or Recorder Stopping
id: c85d0843-21f1-4ef5-aa84-ef05f50861dd
status: test
description: This rule flags CloudTrail events from AWS Config indicating a delivery channel deletion (DeleteDeliveryChannel) or stopping the configuration recorder (StopConfigurationRecorder). Disabling or halting AWS Config can impair visibility into configuration changes, which helps an attacker reduce detection coverage or hinder auditing. The detection relies on CloudTrail telemetry for AWS Config API calls, matching the specified event source and event names.
references:
  - https://docs.aws.amazon.com/config/latest/developerguide/cloudtrail-log-files-for-aws-config.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_config_disable_recording.yml
author: vitaliy0x1, Huntrule Team
date: 2020-01-21
modified: 2022-10-09
tags:
  - attack.defense-impairment
  - attack.t1685.002
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: config.amazonaws.com
    eventName:
      - DeleteDeliveryChannel
      - StopConfigurationRecorder
  condition: selection
falsepositives:
  - Valid change in AWS Config Service
level: high
license: DRL-1.1
related:
  - id: 07330162-dba1-4746-8121-a9647d49d297
    type: derived

What it detects

This rule flags CloudTrail events from AWS Config indicating a delivery channel deletion (DeleteDeliveryChannel) or stopping the configuration recorder (StopConfigurationRecorder). Disabling or halting AWS Config can impair visibility into configuration changes, which helps an attacker reduce detection coverage or hinder auditing. The detection relies on CloudTrail telemetry for AWS Config API calls, matching the specified event source and event names.

Known false positives

Valid change in AWS Config Service

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.