Skip to content

Commit c3da094

Browse files
imays11imays11
committed
AWS CloudWatch Log Retention Policy Set to Short Duration
This PR adds a new detection rule for AWS CloudWatch Log Group retention policy tampering, addressing a coverage gap for the **T1562.008 - Impair Defenses: Disable or Modify Cloud Logs** technique as documented in the [AWS Threat Technique Catalog](https://aws-samples.github.io/threat-technique-catalog-for-aws/Techniques/T1562.008.html). Adversaries may use the `PutRetentionPolicy` API to set suspiciously short retention periods on CloudWatch Log Groups, causing logs to be automatically purged before incident response teams can analyze them. Unlike `DeleteLogGroup` or `DeleteLogStream`, this technique is subtler and may go unnoticed. ### False Positive Considerations During testing, I observed significant false positive potential from **Assumed roles in development environments** - Software development workflows frequently use short retention periods (often 1 day) for ephemeral log groups created during CI/CD pipelines, testing, or local development. Rule severity will remain low for this reason and I've left recommendations for tuning.
1 parent d74c831 commit c3da094

File tree

2 files changed

+162
-0
lines changed

2 files changed

+162
-0
lines changed

‎detection_rules/etc/non-ecs-schema.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -198,6 +198,7 @@
198198
"aws.cloudtrail.flattened.request_parameters.attribute": "keyword",
199199
"aws.cloudtrail.flattened.request_parameters.reason": "keyword",
200200
"aws.cloudtrail.flattened.request_parameters.omitted": "keyword",
201+
"aws.cloudtrail.flattened.request_parameters.retentionInDays": "keyword",
201202
"aws.cloudtrail.flattened.response_elements.documentDescription.documentType": "keyword",
202203
"aws.cloudtrail.flattened.request_parameters.groupSet.items.groupId": "keyword",
203204
"aws.cloudtrail.flattened.request_parameters.protocol": "keyword"

‎rules/integrations/aws/defense_evasion_cloudwatch_short_log_retention_policy.toml‎

Lines changed: 161 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,161 @@
1+
[metadata]
2+
creation_date = "2026/03/12"
3+
integration = ["aws"]
4+
maturity = "production"
5+
updated_date = "2026/03/12"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
Detects when a CloudWatch Log Group retention policy is set to 7 days or less via the PutRetentionPolicy API.
11+
Adversaries may set suspiciously short retention periods to ensure logs are automatically purged before incident
12+
response teams can analyze them. Unlike immediate log deletion, this technique allows logs to be silently removed over
13+
time, making it harder to detect evidence tampering. This rule specifically targets retention periods of < 7 days, which
14+
are unusually short for most production logging use cases.
15+
"""
16+
false_positives = [
17+
"""
18+
Legitimate retention policy changes may occur during cost optimization efforts or compliance adjustments. Verify
19+
whether the user identity, retention period, and target log group align with approved administrative workflows.
20+
Short retention periods on non-critical log groups (e.g., development or testing) may be expected.
21+
""",
22+
]
23+
from = "now-6m"
24+
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
25+
language = "kuery"
26+
license = "Elastic License v2"
27+
name = "AWS CloudWatch Log Retention Policy Set to Short Duration"
28+
note = """## Triage and analysis
29+
30+
### Investigating AWS CloudWatch Log Retention Policy Set to Short Duration
31+
32+
CloudWatch Log Groups store operational and security logs from AWS services and applications. Retention policies control how long logs are preserved before automatic deletion. Adversaries may abuse `PutRetentionPolicy` to set very short retention periods, causing logs to be silently purged over time without triggering obvious deletion alerts.
33+
34+
This technique is subtler than `DeleteLogGroup` or `DeleteLogStream` because:
35+
- The log group continues to exist and appear "healthy"
36+
- Logs are gradually removed rather than immediately deleted
37+
- Monitoring may not notice the change until forensic analysis is needed
38+
39+
### Possible investigation steps
40+
41+
- **Identify the actor**
42+
- Review `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.access_key_id`.
43+
- Determine whether this identity normally manages CloudWatch Logs configuration.
44+
45+
- **Review the retention change**
46+
- Inspect `aws.cloudtrail.request_parameters` for `retentionInDays` value.
47+
- Identify the target `logGroupName` and assess its importance:
48+
- CloudTrail logs, VPC Flow Logs, Lambda functions, or security service logs warrant higher scrutiny.
49+
50+
- **Check source and context**
51+
- Review `source.ip` and `source.geo` for unusual locations.
52+
- Check `user_agent.original` for unexpected tools or automation.
53+
- Look for patterns: multiple log groups modified in succession may indicate automated tampering.
54+
55+
- **Correlate with surrounding activity**
56+
- Search for other defense evasion indicators around the same timestamp:
57+
- `StopLogging`, `DeleteTrail`, `UpdateTrail` (CloudTrail tampering)
58+
- `DeleteLogGroup`, `DeleteLogStream` (direct log deletion)
59+
- IAM permission changes by the same actor
60+
- Check for suspicious activity that the adversary may be trying to hide.
61+
62+
- **Assess business justification**
63+
- Contact the log group owner or platform team to verify whether the change was planned.
64+
- Review change management records for approved retention policy modifications.
65+
66+
### False positive analysis
67+
68+
- **Cost optimization**: Organizations may reduce retention on high-volume, low-value log groups.
69+
- **Compliance adjustments**: Some regulations require specific retention periods.
70+
- **Development/test environments**: Short retention is common for ephemeral workloads.
71+
72+
**Tuning recommendations:**
73+
- Consider excluding known automation IAM roles
74+
- Exclude development/test account IDs if your organization uses separate accounts
75+
- Focus investigation on retention changes to critical log groups (CloudTrail, VPC Flow Logs, security service logs)
76+
77+
### Response and remediation
78+
79+
- **If unauthorized**
80+
- Immediately restore appropriate retention periods on affected log groups.
81+
- Identify what time range of logs may have been lost.
82+
- Restrict permissions for the implicated IAM identity.
83+
84+
- **Investigation**
85+
- Reconstruct missing log data from alternative sources (S3 exports, third-party logging).
86+
- Review the actor's recent CloudTrail activity for other suspicious actions.
87+
- Determine if the retention change coincides with other malicious activity being concealed.
88+
89+
- **Hardening**
90+
- Enforce minimum retention periods via AWS Organizations SCPs.
91+
- Configure AWS Config rules to detect non-compliant retention settings.
92+
- Implement least-privilege access for `logs:PutRetentionPolicy`.
93+
- Set up CloudWatch alarms for retention policy modifications on critical log groups.
94+
95+
### Additional information
96+
97+
- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/)**
98+
- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/)**
99+
"""
100+
references = [
101+
"https://aws-samples.github.io/threat-technique-catalog-for-aws/Techniques/T1562.008.html",
102+
"https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutRetentionPolicy.html",
103+
]
104+
risk_score = 21
105+
rule_id = "7effb6e7-cddc-4ad0-baf6-619cf9d84fa6"
106+
severity = "low"
107+
tags = [
108+
"Domain: Cloud",
109+
"Data Source: AWS",
110+
"Data Source: Amazon Web Services",
111+
"Data Source: Amazon CloudWatch",
112+
"Use Case: Log Auditing",
113+
"Tactic: Defense Evasion",
114+
"Resources: Investigation Guide",
115+
]
116+
timestamp_override = "event.ingested"
117+
type = "query"
118+
119+
query = '''
120+
event.dataset: "aws.cloudtrail"
121+
and event.provider: "logs.amazonaws.com"
122+
and event.action: "PutRetentionPolicy"
123+
and aws.cloudtrail.flattened.request_parameters.retentionInDays: (1 or 2 or 3 or 4 or 5 or 6)
124+
and event.outcome: "success"
125+
'''
126+
127+
128+
[[rule.threat]]
129+
framework = "MITRE ATT&CK"
130+
[[rule.threat.technique]]
131+
id = "T1562"
132+
name = "Impair Defenses"
133+
reference = "https://attack.mitre.org/techniques/T1562/"
134+
[[rule.threat.technique.subtechnique]]
135+
id = "T1562.008"
136+
name = "Disable or Modify Cloud Logs"
137+
reference = "https://attack.mitre.org/techniques/T1562/008/"
138+
139+
140+
141+
[rule.threat.tactic]
142+
id = "TA0005"
143+
name = "Defense Evasion"
144+
reference = "https://attack.mitre.org/tactics/TA0005/"
145+
146+
[rule.investigation_fields]
147+
field_names = [
148+
"@timestamp",
149+
"user.name",
150+
"user_agent.original",
151+
"source.ip",
152+
"aws.cloudtrail.user_identity.arn",
153+
"aws.cloudtrail.user_identity.type",
154+
"aws.cloudtrail.user_identity.access_key_id",
155+
"event.action",
156+
"event.outcome",
157+
"cloud.account.id",
158+
"cloud.region",
159+
"aws.cloudtrail.request_parameters",
160+
]
161+

0 commit comments

Comments
 (0)