AWS Config Disabling Channel/Recorder

Title: AWS Config Disabling Channel/Recorder
Status: test
Description:Detects AWS Config Service disabling
References:
  -https://docs.aws.amazon.com/config/latest/developerguide/cloudtrail-log-files-for-aws-config.html
Author: vitaliy0x1
Date: 2020-01-21
modified:2022-10-09
Tags:

• -'attack.defense-impairment'
• -'attack.t1685.002'

Logsource:

• product: aws
• service: cloudtrail

Detection:
  selection:
    eventSource: 'config.amazonaws.com'
    eventName:
      -'DeleteDeliveryChannel'
      -'StopConfigurationRecorder'

  condition:selection
Falsepositives:
  -Valid change in AWS Config Service
Level: high