AWS CloudWatch Log Stream Deletion

  1[metadata]
  2creation_date = "2020/05/20"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/01/21"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects the deletion of an Amazon CloudWatch log stream using the "DeleteLogStream" API. Deleting a log stream
 11permanently removes its associated log events and may disrupt security visibility, break audit trails, or suppress
 12forensic evidence. Adversaries may delete log streams to conceal malicious actions, impair monitoring pipelines, or
 13remove artifacts generated during post-exploitation activity.
 14"""
 15false_positives = [
 16    """
 17    CloudWatch log streams may be deleted legitimately during log rotation processes, test environment resets, or
 18    infrastructure deployments that recreate log groups and streams. Validate the identity, automation pipeline, and IP
 19    address associated with the deletion. If deletions are expected from specific CI/CD systems or administrative roles,
 20    consider adding targeted exceptions.
 21    """,
 22]
 23from = "now-6m"
 24index = ["filebeat-*", "logs-aws.cloudtrail-*"]
 25language = "kuery"
 26license = "Elastic License v2"
 27name = "AWS CloudWatch Log Stream Deletion"
 28note = """## Triage and analysis
 29
 30### Investigating AWS CloudWatch Log Stream Deletion
 31
 32CloudWatch log streams contain sequential log events from a single application, service, or AWS resource.  
 33Deleting a log stream permanently removes its archived log events, which may disable monitoring workflows, eliminate 
 34critical telemetry, or disrupt forensic visibility.
 35
 36Adversaries may delete log streams to cover their tracks after unauthorized actions, break ingestion pipelines feeding SIEM, alerting, or anomaly detection or to remove evidence before escalating privileges or moving laterally. This rule detects successful invocations of the `DeleteLogStream` API from CloudTrail.
 37
 38#### Possible investigation steps
 39
 40- **Identify the actor**
 41  - Review `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.access_key_id`.  
 42  - Confirm whether the user or role normally manages CloudWatch Logs resources.
 43
 44- **Review request details**
 45  - Inspect `aws.cloudtrail.request_parameters` to determine which log stream and parent log group were deleted.  
 46  - Assess the importance of the deleted stream:
 47    - Was it used for VPC Flow Logs, CloudTrail, Lambda functions, ECS tasks, or application logs?  
 48    - Did it contain logs used for security detection or compliance auditing?
 49
 50- **Examine request origin and context**
 51  - Review `source.ip` and `user_agent.original` for anomalies (e.g., unfamiliar CLI tools, suspicious automation, 
 52    unknown IP ranges, or external geolocations).
 53  - Validate whether the request originated from a legitimate automation host or jump box.  
 54  - Check activity around the same timestamp for related operations such as:
 55    - `DeleteLogGroup`
 56    - `StopLogging`, `UpdateTrail`, or `DeleteTrail`
 57    - GuardDuty detector or CloudWatch alarm deletions
 58    - IAM policy or role modifications
 59
 60- **Determine operational justification**
 61  - Consult change management systems or deployment pipelines to confirm whether the deletion was planned.  
 62  - Contact application owners or platform teams to determine whether the log stream was part of normal rotation or cleanup.
 63
 64- **Investigate broader compromise indicators**
 65  - Look for suspicious activity by the same identity in the past 24–48 hours, such as:
 66    - Failed authentication attempts  
 67    - IAM privilege escalations  
 68    - Unusual STS AssumeRole usage  
 69    - Access from new geolocations  
 70
 71### False positive analysis
 72
 73- **Log rotation and automation**
 74  - Some systems delete log streams automatically when rolling new deployments or recycling compute resources.
 75  - CI/CD pipelines managing immutable infrastructure may delete and recreate streams during each deploy.
 76
 77- **Test and development accounts**
 78  - Dev/test environments may frequently create and delete log streams as part of iterative work.
 79
 80- **Bulk cleanup operations**
 81  - Platform engineering teams may delete obsolete log streams during cost-optimization or log-retention management.
 82
 83If the rule triggers frequently from known infrastructure accounts or automation hosts, consider adding narrow exceptions using a combination of IAM role, IP range, or user agent.
 84
 85### Response and remediation
 86
 87- **Containment**
 88  - If the deletion is unauthorized, review other CloudWatch resources for additional tampering (alarms, log groups, metric filters).
 89  - Temporarily restrict permissions for the implicated IAM user or role.
 90
 91- **Investigation**
 92  - Reconstruct any missing telemetry from alternative sources (e.g., S3 buckets, application logs, third-party logging systems).
 93  - Review CloudTrail and Config timelines for preceding suspicious events.
 94  - Validate whether the deleted log stream contained evidence of prior compromise.
 95
 96- **Recovery and hardening**
 97  - Implement IAM least-privilege for `logs:DeleteLogStream`.
 98  - Enable AWS Config rules to monitor CloudWatch Logs configuration changes.  
 99  - Ensure that business-critical log groups enforce minimum retention periods and prevent accidental deletion.
100  - Integrate log stream lifecycle management into CI/CD to avoid manual deletions.
101  - Establish guardrails using Service Control Policies (SCPs) to block log deletions outside designated automation roles.
102
103### Additional information
104
105- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)** 
106- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)** 
107- **Security Best Practices:** [AWS Knowledge Center – Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/).
108"""
109references = [
110    "https://awscli.amazonaws.com/v2/documentation/api/latest/reference/logs/delete-log-stream.html",
111    "https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DeleteLogStream.html",
112]
113risk_score = 47
114rule_id = "d624f0ae-3dd1-4856-9aad-ccfe4d4bfa17"
115severity = "medium"
116tags = [
117    "Domain: Cloud",
118    "Data Source: AWS",
119    "Data Source: Amazon Web Services",
120    "Data Source: Amazon CloudWatch",
121    "Use Case: Log Auditing",
122    "Tactic: Defense Evasion",
123    "Tactic: Impact",
124    "Resources: Investigation Guide",
125]
126timestamp_override = "event.ingested"
127type = "query"
128
129query = '''
130event.dataset: "aws.cloudtrail" 
131  and event.provider: "logs.amazonaws.com" 
132  and event.action: "DeleteLogStream" 
133  and event.outcome: "success"
134  and source.ip: * 
135  and not user_agent.original : "AWS Internal"
136'''
137
138
139[[rule.threat]]
140framework = "MITRE ATT&CK"
141[[rule.threat.technique]]
142id = "T1485"
143name = "Data Destruction"
144reference = "https://attack.mitre.org/techniques/T1485/"
145
146
147[rule.threat.tactic]
148id = "TA0040"
149name = "Impact"
150reference = "https://attack.mitre.org/tactics/TA0040/"
151[[rule.threat]]
152framework = "MITRE ATT&CK"
153[[rule.threat.technique]]
154id = "T1562"
155name = "Impair Defenses"
156reference = "https://attack.mitre.org/techniques/T1562/"
157[[rule.threat.technique.subtechnique]]
158id = "T1562.001"
159name = "Disable or Modify Tools"
160reference = "https://attack.mitre.org/techniques/T1562/001/"
161
162
163
164[rule.threat.tactic]
165id = "TA0005"
166name = "Defense Evasion"
167reference = "https://attack.mitre.org/tactics/TA0005/"
168
169[rule.investigation_fields]
170field_names = [
171    "@timestamp",
172    "user.name",
173    "user_agent.original",
174    "source.ip",
175    "aws.cloudtrail.user_identity.arn",
176    "aws.cloudtrail.user_identity.type",
177    "aws.cloudtrail.user_identity.access_key_id",
178    "event.action",
179    "event.outcome",
180    "cloud.account.id",
181    "cloud.region",
182    "aws.cloudtrail.request_parameters",
183]