aws_config_disable_recording.yml

title: AWS Config Disabling Channel/Recorder
id: 07330162-dba1-4746-8121-a9647d49d297
status: experimental
author: vitaliy0x1
date: 2020/01/21
description: Detects AWS Config Service disabling
logsource:
    service: cloudtrail
detection:
    selection_source:
        - eventSource: config.amazonaws.com
    events:
        - eventName:
            - DeleteDeliveryChannel
            - StopConfigurationRecorder
    condition: selection_source AND events
level: high
falsepositives:
    - Valid change in AWS Config Service
tags:
    - attack.t1089
    - attack.t1562.001