AWS Config Resource Deletion

ELASTIC detection rule by Elastic, Austin Songer · Elastic License v2

Identifies attempts to delete AWS Config resources. AWS Config provides continuous visibility into resource configuration changes and compliance posture across an account. Deleting Config components can significantly reduce security visibility and auditability. Adversaries may delete or disable Config resources to evade detection, hide prior activity, or weaken governance controls before or after other malicious actions.

[metadata]
creation_date = "2020/06/26"
integration = ["aws"]
maturity = "production"
updated_date = "2026/08/05"

[rule]
author = ["Elastic", "Austin Songer"]
description = """
Identifies attempts to delete AWS Config resources. AWS Config provides continuous visibility into resource
configuration changes and compliance posture across an account. Deleting Config components can significantly reduce
security visibility and auditability. Adversaries may delete or disable Config resources to evade detection, hide prior
activity, or weaken governance controls before or after other malicious actions.
"""
false_positives = [
    """
    Deletion of AWS Config resources may occur during legitimate account restructuring, environment teardown, or changes
    to compliance tooling. Centralized security teams or approved automation may also delete and recreate Config
    components as part of controlled workflows. Confirm that the action aligns with approved change management and was
    performed by an expected principal.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS Config Resource Deletion"
note = """## Triage and analysis

### Investigating AWS Config Resource Deletion

AWS Config records configuration changes, relationships, and compliance status for AWS resources over time.
Deleting Config components such as recorders, delivery channels, rules, or conformance packs disrupts
security monitoring, compliance enforcement, and forensic visibility. This behavior is uncommon outside of
planned infrastructure changes and should be treated as high-risk when unexpected. This rule detects successful deletion of AWS Config resources.

### Possible investigation steps

**Identify the actor**
- Review `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.access_key_id` to determine who initiated the deletion.
- Confirm whether this principal typically manages AWS Config or centralized security tooling.
- Check `user_agent.original` to determine whether the action was performed via console, CLI, SDK, or automation.

**Determine what was deleted**
- Inspect `event.action` and `aws.cloudtrail.request_parameters` to identify which Config component was removed
  (e.g., configuration recorder, delivery channel, rule, aggregator, or conformance pack).
- Assess whether the deleted resource was account-scoped or organization-wide. Used for compliance reporting, guardrails, or security monitoring.
- Identify the affected regions and accounts using `cloud.region` and `cloud.account.id`.

**Reconstruct timing and intent**
- Use `@timestamp` to correlate the deletion with:
  - IAM changes (role updates, policy modifications, STS activity).
  - Other monitoring disruptions (CloudTrail, GuardDuty, Security Hub).
  - Destructive or high-impact actions occurring shortly before or after.
- Compare the timing against approved maintenance windows or infrastructure changes.

**Correlate with broader activity**
- Pivot in CloudTrail on the same principal or access key to identify:
  - Additional attempts to disable logging or security controls.
  - Resource deletions or configuration weakening across services.
- Evaluate whether the deletion appears isolated or part of a broader evasion sequence.

**Validate intent with stakeholders**
- Confirm with security, cloud platform, or compliance teams whether the deletion was planned and approved.
- Verify whether replacement Config resources were created shortly after, or whether monitoring remains disabled.

### False positive analysis

- **Planned environment changes**
  - Non-production account teardown, environment consolidation, or compliance tool migrations may involve
    deletion of Config resources.

- **Authorized security automation**
  - Approved automation or security tooling may delete and recreate Config components during setup or remediation.
  - Tune exceptions carefully using specific principals or automation roles rather than broad exclusions.

### Response and remediation

- **Contain and restore visibility**
  - If unauthorized, immediately re-enable AWS Config components, including recorders and delivery channels.
  - Validate that historical configuration data and compliance reporting resume as expected.

- **Investigate scope and impact**
  - Determine how long Config visibility was impaired and what activity may have occurred during that window.
  - Review other monitoring gaps (e.g., CloudTrail or GuardDuty changes) for coordinated evasion.

- **Credential and access review**
  - Rotate or disable credentials associated with the deleting principal if compromise is suspected.
  - Review IAM permissions to ensure only a minimal, well-defined set of roles can manage AWS Config.

- **Hardening and prevention**
  - Use SCPs or IAM conditions to restrict deletion of Config resources in production and security accounts.
  - Implement AWS Config rules or Security Hub controls to alert when Config is disabled or degraded.
  - Document and formalize change procedures for governance tooling.

### Additional information
- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)** 
- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)** 
- **[AWS Knowledge Center – Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/)**
"""
references = [
    "https://docs.aws.amazon.com/config/latest/developerguide/how-does-config-work.html",
    "https://docs.aws.amazon.com/config/latest/APIReference/API_Operations.html",
]
risk_score = 47
rule_id = "7024e2a0-315d-4334-bb1a-552d604f27bc"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Platform: AWS",
    "Data Source: AWS CloudTrail",
    "Service: AWS Config",
    "Tactic: Defense Evasion",
    "Rule Type: Custom Query (KQL)",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: aws.cloudtrail 
    and event.provider: config.amazonaws.com 
    and event.outcome: success
    and event.action: (DeleteConfigRule or DeleteOrganizationConfigRule or DeleteConfigurationAggregator or
    DeleteConfigurationRecorder or DeleteConformancePack or DeleteOrganizationConformancePack or
    DeleteDeliveryChannel or DeleteRemediationConfiguration or DeleteRetentionConfiguration)
    and not aws.cloudtrail.user_identity.invoked_by: (securityhub.amazonaws.com or fms.amazonaws.com or controltower.amazonaws.com or config-conforms.amazonaws.com)
    and not user_agent.original: (*Pulumi* or *Terraform*)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"

[[rule.threat.technique.subtechnique]]
id = "T1562.008"
name = "Disable or Modify Cloud Logs"
reference = "https://attack.mitre.org/techniques/T1562/008/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters"
]

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

29ebd155-8deb-472d-bbaa-33891069be18

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion