MATCH-S00665.md

Rules: AWS CloudWatch Log Group Deletion

Description

Detects the AWS CloudWatch DeleteLogGroup API action. DeleteLogGroup deletes the specified log group and permanently deletes all the archived log events associated with the log group.

Additional Details

Detail	Value
Type	Templated Match
Category	Defense Evasion
Apply Risk to Entities	device_ip, user_username, srcDevice_ip, device_hostname, srcDevice_hostname
Signal Name	AWS CloudWatch Log Group Deletion
Summary Expression	{{action}} performed by user: {{user_username}}
Score/Severity	Static: 2
Enabled by Default	True
Prototype	False
Tags	_mitreAttackTechnique:T1562, _mitreAttackTactic:TA0005, _mitreAttackTechnique:T1562.008, _mitreAttackTechnique:T1562.001

Vendors and Products

• Amazon AWS - CloudTrail

Fields Used

Origin	Field
Normalized Schema	action
Normalized Schema	application
Normalized Schema	device_hostname
Normalized Schema	device_ip
Normalized Schema	listMatches
Normalized Schema	metadata_product
Normalized Schema	metadata_vendor
Normalized Schema	srcDevice_hostname
Normalized Schema	srcDevice_ip
Normalized Schema	user_username