{"id":"07330162-dba1-4746-8121-a9647d49d297","title":"AWS Config Disabling Channel/Recorder","description":"Detects AWS Config Service disabling","author":"vitaliy0x1","status":"test","level":"high","date":"2020-01-21","modified":"2022-10-09","tags":["attack.defense-impairment","attack.t1685.002"],"technique_ids":["T1685.002"],"logsource":{"product":"aws","service":"cloudtrail"},"falsepositives":["Valid change in AWS Config Service"],"references":["https://docs.aws.amazon.com/config/latest/developerguide/cloudtrail-log-files-for-aws-config.html"],"source_path":"rules/cloud/aws/cloudtrail/aws_config_disable_recording.yml","source_sha256":"d53eb7e1c2b87a31bd7ca7558f3eda1d15ceb4646451e8e0405d78618480aea6","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_config_disable_recording.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: AWS Config Disabling Channel/Recorder\nid: 07330162-dba1-4746-8121-a9647d49d297\nstatus: test\ndescription: Detects AWS Config Service disabling\nreferences:\n    - https://docs.aws.amazon.com/config/latest/developerguide/cloudtrail-log-files-for-aws-config.html\nauthor: vitaliy0x1\ndate: 2020-01-21\nmodified: 2022-10-09\ntags:\n    - attack.defense-impairment\n    - attack.t1685.002\nlogsource:\n    product: aws\n    service: cloudtrail\ndetection:\n    selection:\n        eventSource: 'config.amazonaws.com'\n        eventName:\n            - 'DeleteDeliveryChannel'\n            - 'StopConfigurationRecorder'\n    condition: selection\nfalsepositives:\n    - Valid change in AWS Config Service\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685.002","id":"T1685.002","name":"Disable or Modify Cloud Log","page":"techniques/enterprise/T1685.002/"}],"data_path":"data/detection-rules/07330162-dba1-4746-8121-a9647d49d297.json","kind":"sigma"}