AWS CloudTrail Detects EC2 DeleteFlowLogs API Calls
Flags successful EC2 DeleteFlowLogs API calls in CloudTrail indicating VPC Flow Logs were removed.
FreeReviewedSigma · High · v5
- Product
- aws
- Service
- cloudtrail
- Author
- Ivan Saakov (SigmaHQ), DRL 1.1
- Published
- 2025-10-19
- Updated
- 2026-07-31
What it detects
This rule flags successful DeleteFlowLogs actions against VPC Flow Logs in AWS EC2 using CloudTrail event data. Deleting flow logs can remove visibility into network activity and can hinder investigations following suspicious or malicious behavior. It relies on telemetry containing the CloudTrail eventName "DeleteFlowLogs" and an errorCode indicating success or absence of an error.
Reporting behind it
- docs.aws.amazon.comhttps://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteFlowLogs.html
- awscli.amazonaws.comhttps://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/delete-flow-logs.html
- elastic.cohttps://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_ec2_flow_log_deletion
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_vpc_flow_logs_deleted.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
aws-cloudtrail-vpc-flow-logs-deleted-via-ec2-deleteflowlogs-e386b9b5
title: AWS CloudTrail Detects EC2 DeleteFlowLogs API Calls
id: 38b7985d-6389-47eb-bf06-aab1a6915389
status: experimental
description: This rule flags successful DeleteFlowLogs actions against VPC Flow Logs in AWS EC2 using CloudTrail event data. Deleting flow logs can remove visibility into network activity and can hinder investigations following suspicious or malicious behavior. It relies on telemetry containing the CloudTrail eventName "DeleteFlowLogs" and an errorCode indicating success or absence of an error.
references:
- https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteFlowLogs.html
- https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/delete-flow-logs.html
- https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_ec2_flow_log_deletion
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_vpc_flow_logs_deleted.yml
author: Ivan Saakov, Huntrule Team
date: 2025-10-19
tags:
- attack.stealth
logsource:
product: aws
service: cloudtrail
detection:
selection_event_name:
eventName: DeleteFlowLogs
selection_status_success:
errorCode: Success
selection_status_null:
errorCode: null
condition: selection_event_name and 1 of selection_status_*
falsepositives:
- During maintenance operations or testing, authorized administrators may delete VPC Flow Logs as part of routine network management or cleanup activities.
level: high
license: DRL-1.1
related:
- id: e386b9b5-af12-450e-afff-761730fb8a98
type: derived