AWS Route53 DNS Resolver query logging configuration deletion

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	AWS Audit Log
Detection Modules	Cloud
Detector Tags	Cloud Log Tampering Analytics
ATT&CK Tactic	Defense Impairment (TA0112)
ATT&CK Technique	Disable or Modify Tools: Disable or Modify Cloud Log (T1685.002)
Severity	Low

Description

An AWS identity has deleted Route53 DNS Resolver query logging configuration.

Attacker's Goals

Evade detection while performing DNS traffic or tunneling.

Investigative actions

• Check if there were any network attempts that fit the deleted rule.
• Check The cloud identity activity prior/after to the configuration deletion.

Variations

Successful AWS Route53 DNS Resolver query logging configuration deletion by a non-admin identity

Synopsis

Field	Value
ATT&CK Tactic	Defense Impairment (TA0112)
ATT&CK Technique	Disable or Modify Tools: Disable or Modify Cloud Log (T1685.002)
Severity	Medium

Description

An AWS identity has deleted Route53 DNS Resolver query logging configuration.

Attacker's Goals

Evade detection while performing DNS traffic or tunneling.

Investigative actions

• Check if there were any network attempts that fit the deleted rule.
• Check The cloud identity activity prior/after to the configuration deletion.