Skip to content

[New Rule] AWS Audit or Security Service Tampering via CLI - #6783

Open
bryans3c wants to merge 5 commits into
mainfrom
new-rule/aws-audit-or-security-service-tampering-via-cli
Open

bryans3c wants to merge 5 commits into
mainfrom
new-rule/aws-audit-or-security-service-tampering-via-cli

Conversation

@bryans3c

Copy link
Copy Markdown
Contributor

Pull Request

Issue link(s):

Summary - What I changed

Added defense_evasion_aws_audit_and_security_service_tampering_via_cli, a process rule that fires when the AWS CLI is used to disable, delete, or blind the following AWS audit and security services: CloudTrail (stop-logging, delete-trail, delete-event-data-store, put-event-selectors, update-trail narrowing), GuardDuty (delete-detector, update-detector --no-enable, create-filter, delete-publishing-destination), AWS Config (stop-configuration-recorder, delete-configuration-recorder, delete-delivery-channel), Security Hub (disable-security-hub, batch-disable-standards), Access Analyzer (delete-analyzer), Macie (disable-macie), Inspector (disable), Detective (delete-graph), CloudWatch Logs (delete-log-group, delete-log-stream, put-retention-policy --retention-in-days 1), and S3 audit infrastructure (delete-bucket-policy, put-bucket-logging).

Why it matters

Disabling CloudTrail and GuardDuty is the first step in nearly every documented cloud intrusion playbook. SCARLETEEL disabled CloudTrail before exfiltrating Terraform state and credentials. The Datadog Cloud Security Atlas records CloudTrail disabling as the most common defense-evasion step in post-exploitation. Because the rule fires on the endpoint before the AWS API call completes, it detects the tampering even when the adversary's goal is to suppress the very CloudTrail event that would record it.

Service covered Commands matched
CloudTrail stop-logging, delete-trail, delete-event-data-store, put-event-selectors
GuardDuty delete-detector, update-detector --no-enable, create-filter
AWS Config stop-configuration-recorder, delete-configuration-recorder
Security Hub disable-security-hub, batch-disable-standards
Access Analyzer / Macie / Inspector / Detective delete-analyzer, disable-macie, disable, delete-graph
CloudWatch Logs delete-log-group, delete-log-stream, put-retention-policy 1d
S3 audit delete-bucket-policy, put-bucket-logging

How To Test

image
event.category : "process" and event.type : "start" and event.action : (start or exec) and
process.name : (aws or aws.exe or aws2 or "aws-cli") and
process.command_line : (
  *cloudtrail stop-logging* or
  *cloudtrail delete-trail* or
  *cloudtrail delete-event-data-store* or
  *cloudtrail put-event-selectors* or
  *cloudtrail update-trail*--no-is-multi-region-trail* or
  *cloudtrail update-trail*--no-include-global-service-events* or
  *guardduty delete-detector* or
  *guardduty update-detector*--no-enable* or
  *guardduty create-filter* or
  *guardduty delete-publishing-destination* or
  *configservice stop-configuration-recorder* or
  *configservice delete-configuration-recorder* or
  *configservice delete-delivery-channel* or
  *securityhub disable-security-hub* or
  *securityhub batch-disable-standards* or
  *accessanalyzer delete-analyzer* or
  *macie2 disable-macie* or
  *inspector2 disable* or
  *detective delete-graph* or
  *logs delete-log-group* or
  *logs delete-log-stream* or
  *logs put-retention-policy*--retention-in-days 1* or
  *s3api delete-bucket-policy* or
  *s3api put-bucket-logging*
) and not process.command_line : (*--dry-run* or *help* or *--version* or *describe* or *list-* or *get-*)

Checklist

  • Added a label for the type of pr: Rule: New Rule
  • query is inclusive, not overly exclusive
  • name and description are descriptive and free of typos
  • Secret and sensitive material has been managed correctly
  • Reviewed the PR telemetry comment (informational)
  • Post-merge noise check: python -m endpoint_rules ci verify-tuning-outcome --pr-number N

@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Sep 15, 2026 •

Copy link
Copy Markdown

⛔️ Test failed

Results
  • ❌ AWS Audit or Security Service Tampering via CLI (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Five unresolved findings remain covering taxonomy, action coverage, retention matching, exclusions, and service tags.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds a cross-platform Elastic Defend KQL rule detecting AWS CLI tampering with audit and security services.

Changes:

  • Detects disabling, deletion, and modification across multiple AWS security services.
  • Adds endpoint setup guidance, metadata, tags, ATT&CK mappings, and references.
File summaries
File Summary and review findings
rules/cross-platform/defense_evasion_aws_audit_and_security_service_tampering_via_cli.toml Adds the AWS CLI tampering rule. Findings remain for rule-type taxonomy (nit, 3 votes), event-action coverage (moderate, 2 votes), retention matching (moderate, 2 votes), command exclusion scope (moderate, 3 votes), and service tags (nit, 1 vote).
Review details

Suppressed comments (1)

rules/cross-platform/defense_evasion_aws_audit_and_security_service_tampering_via_cli.toml:72

  • The only service tag is Service: AWS GuardDuty, but this rule also matches CloudTrail, Config, Security Hub, S3, CloudWatch Logs, Access Analyzer, Macie, Inspector, and Detective operations. This makes service-based filtering misleading; add canonical service tags for the other covered services or remove the GuardDuty-only tag.
    "Service: AWS GuardDuty",
  • Files reviewed: 1/1 changed files
  • Comments generated: 4
  • Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

type = "query"

query = '''
event.category : "process" and event.type : "start" and event.action : (start or exec) and
*detective delete-graph* or
*logs delete-log-group* or
*logs delete-log-stream* or
*logs put-retention-policy*--retention-in-days 1* or
*logs put-retention-policy*--retention-in-days 1* or
*s3api delete-bucket-policy* or
*s3api put-bucket-logging*
) and not process.command_line : (*--dry-run* or *help* or *--version* or *describe* or *list-* or *get-*)
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Sep 15, 2026 •

Copy link
Copy Markdown

⛔️ Test failed

Results
  • ❌ AWS Audit or Security Service Tampering via CLI (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Sep 15, 2026 •

Copy link
Copy Markdown

⛔️ Test failed

Results
  • ❌ AWS Audit or Security Service Tampering via CLI (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Sep 15, 2026 •

Copy link
Copy Markdown

⛔️ Test failed

Results
  • ❌ AWS Audit or Security Service Tampering via CLI (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Sep 15, 2026 •

Copy link
Copy Markdown

⛔️ Test failed

Results
  • ❌ AWS Audit or Security Service Tampering via CLI (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

*inspector2 disable* or
*logs delete-log-group* or
*logs delete-log-stream* or
*logs put-retention-policy*--retention-in-days 1* or

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This would miss --retention-in-days=1 and --retention-in-days 0 is that intentional?

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants