Classification:

compliance

Tactic:

TA0005-defense-evasion

Technique:

T1562-impair-defenses

Framework:

cis-aws

Control:

4.9

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detect when an attacker is trying to evade defenses by disabling or modifying AWS Config.

Strategy

This rule lets you monitor these AWS Config API calls per CIS-AWS-4.9: Ensure a log metric filter and alarm exist for AWS Config configuration changes:

• StopConfigurationRecorder
• DeleteDeliveryChannel
• PutDeliveryChannel
• PutConfigurationRecorder

Triage and response

1. Determine which if {{@userIdentity.arn}} should have done a {{@evt.name}} to AWS Config.
2. If the user did not make the API call:
   • Rotate the credentials.
   • Investigate if the same credentials made other unauthorized API calls.

Changelog

• 1 April 2022 - Updated rule and signal message.
• 10 October 2022 - Updated severities.