AWS CloudTrail: VPC Flow Logs Deleted via EC2 DeleteFlowLogs

title: "AWS CloudTrail: VPC Flow Logs Deleted via EC2 DeleteFlowLogs"
id: 38b7985d-6389-47eb-bf06-aab1a6915389
status: experimental
description: This rule identifies successful deletion of one or more VPC Flow Logs using the EC2 DeleteFlowLogs API in AWS CloudTrail. Deleting flow logs can reduce or remove visibility into network activity, which may impede incident response and forensic investigation. The detection relies on CloudTrail eventName matching DeleteFlowLogs and the presence of a Success outcome or null errorCode.
references:
  - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteFlowLogs.html
  - https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/delete-flow-logs.html
  - https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_ec2_flow_log_deletion
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_vpc_flow_logs_deleted.yml
author: Ivan Saakov, Huntrule Team
date: 2025-10-19
tags:
  - attack.stealth
logsource:
  product: aws
  service: cloudtrail
detection:
  selection_event_name:
    eventName: DeleteFlowLogs
  selection_status_success:
    errorCode: Success
  selection_status_null:
    errorCode: null
  condition: selection_event_name and 1 of selection_status_*
falsepositives:
  - During maintenance operations or testing, authorized administrators may delete VPC Flow Logs as part of routine network management or cleanup activities.
level: high
license: DRL-1.1
related:
  - id: e386b9b5-af12-450e-afff-761730fb8a98
    type: derived