Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

AWSCloudTrail - Config Service Resource Deletion Attempts

Identifies AWS API calls that attempt to reduce logging or visibility in an account by stopping logging, deleting trails, deleting flow logs, or deleting event buses. This behavior can indicate defense evasion or the deliberate suppression of telemetry used to monitor security posture.

ATT&CK coverage

Outside the enterprise matrix

T1685.002Disable or Modify Cloud LogMapped as T1562.008, withdrawn by ATT&CK.

Detection requirements

Log source product: aws awss3
Log source service: awscloudtrail

What the source says

Tagged by the source as

DefenseEvasion

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.