Skip to content

Commit e952ff9

Browse files
committed
[Rule Tunings] AWS Route53 Rules
AWS Route53 Resolver Query Log Configuration Deleted - updated title - updated Description, FP and IG sections - reduced execution window - updated tags - added highlighted fields AWS Route53 Domain Transfer Lock Disabled - increased rule severity to high - corrected `event.provider` value in query - updated title - updated Description, FP and IG sections - reduced execution window - added highlighted fields - updated Mitre AWS Route53 Domain Transferred to Another Account - increased rule severity to high - corrected `event.provider` value in query - updated title - updated Description, FP and IG sections - reduced execution window - added highlighted fields - updated Mitre AWS Route53 Private Hosted Zone Associated With a VPC - increased rule severity to medium - corrected `event.provider` value in query - updated title - updated Description, FP and IG sections - reduced execution window - added highlighted fields - updated Mitre
1 parent f4085ad commit e952ff9

4 files changed

+437
-153
lines changed

rules/integrations/aws/defense_evasion_route53_dns_query_resolver_config_deletion.toml

Lines changed: 105 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -2,59 +2,96 @@
22
creation_date = "2024/04/12"
33
integration = ["aws"]
44
maturity = "production"
5-
updated_date = "2025/01/10"
5+
updated_date = "2025/12/10"
66

77
[rule]
88
author = ["Elastic"]
99
description = """
10-
Identifies when a Route53 Resolver Query Log Configuration is deleted. When a Route53 Resolver query log configuration
11-
is deleted, Resolver stops logging DNS queries and responses for the specified configuration. Adversaries may delete
12-
query log configurations to evade detection or cover their tracks.
10+
Identifies the deletion of an Amazon Route 53 Resolver Query Log Configuration. Resolver query logs provide critical
11+
visibility into DNS activity across VPCs, including lookups made by EC2 instances, containers, Lambda functions, and
12+
other AWS resources. Deleting a query log configuration immediately stops DNS query and response logging for the
13+
associated VPC. Adversaries may delete these configurations to evade detection, suppress forensic evidence, or degrade
14+
security monitoring capabilities.
1315
"""
14-
false_positives = ["Legitimate deletion of Route53 Resolver Query Log Configuration by authorized personnel."]
15-
from = "now-60m"
16+
false_positives = [
17+
"""
18+
Query log configuration deletions may occur during legitimate networking changes, logging pipeline updates, or
19+
infrastructure redesign. Confirm the activity aligns with expected operations before taking action.
20+
""",
21+
]
22+
from = "now-6m"
1623
index = ["filebeat-*", "logs-aws.cloudtrail*"]
17-
interval = "10m"
1824
language = "kuery"
1925
license = "Elastic License v2"
20-
name = "Route53 Resolver Query Log Configuration Deleted"
21-
note = """
22-
## Triage and analysis
23-
24-
### Investigating Route53 Resolver Query Log Configuration Deleted
25-
26-
This rule detects when a Route53 Resolver Query Log Configuration is deleted. Deleting these configurations stops the logging of DNS queries and responses, which can significantly impede network monitoring and compromise security visibility. Adversaries may delete these configurations to evade detection, remove evidence, or obscure their activities within a network.
27-
28-
Adversaries target Route53 Resolver query log configurations because these logs can contain evidence of malicious domain queries or responses. By deleting these logs, an adversary can prevent the capture of information that could reveal unauthorized network activities, aiding in avoiding detection and thwarting incident response efforts.
29-
30-
#### Possible Investigation Steps
31-
32-
- **Review the Deletion Details**: Examine the CloudTrail logs to identify when and by whom the deletion was initiated.
33-
- Check the `event.action` and `user_identity` elements to understand the scope and authorization of the deletion.
34-
- **Contextualize with User Actions**: Assess whether the deletion aligns with the user’s role and job responsibilities.
35-
- Investigate if similar modifications have occurred recently that could suggest a pattern or broader campaign.
36-
- **Analyze Access Patterns and Permissions**: Verify whether the user had the appropriate permissions to delete log configurations.
37-
- Investigate any recent permission changes that might indicate role abuse or credentials compromise.
38-
- **Correlate with Other Security Incidents**: Look for related security alerts or incidents that could be connected to the log deletion.
39-
- This includes unusual network traffic, alerts from other AWS services, or findings from intrusion detection systems.
40-
- **Interview the Responsible Team**: If the deletion was initiated by an internal team member, confirm their intent and authorization to ensure it was a legitimate action.
41-
42-
### False Positive Analysis
43-
44-
- **Legitimate Administrative Actions**: Confirm that the deletion was part of scheduled IT operations or network management activities, possibly linked to maintenance or infrastructure updates. Validate this action against change management records or through interviews with relevant personnel.
45-
46-
### Response and Remediation
47-
48-
- **Restore Logs if Feasible**: If the deletion was unauthorized, consider restoring the configuration from backups to ensure continuous visibility into DNS queries.
49-
- **Review and Tighten Permissions**: Ensure that only authorized personnel have the capability to delete critical configurations.
50-
- Adjust AWS IAM policies to reinforce security measures.
51-
- **Enhance Monitoring of Log Management**: Implement or enhance monitoring rules to detect and alert on unauthorized changes to logging configurations, focusing on critical deletions.
52-
- **Conduct Comprehensive Security Review**: If the deletion is verified as malicious, initiate a thorough security assessment to identify any further unauthorized changes or ongoing malicious activities.
53-
54-
### Additional Information
55-
56-
For detailed instructions on managing Route53 Resolver and securing its configurations, refer to the [Amazon Route53 Resolver documentation](https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_DeleteResolverQueryLogConfig.html).
57-
26+
name = "AWS Route 53 Resolver Query Log Configuration Deleted"
27+
note = """## Triage and analysis
28+
29+
> **Disclaimer**:
30+
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
31+
32+
### Investigating AWS Route 53 Resolver Query Log Configuration Deleted
33+
34+
Route 53 Resolver query logs provide essential telemetry for DNS visibility across AWS environments. Deleting a Resolver Query Log Configuration immediately halts DNS logging for one or more VPCs, creating a significant monitoring gap. Adversaries may intentionally delete these configurations to hide malicious activity. This rule detects successful invocations of `DeleteResolverQueryLogConfig`.
35+
36+
### Possible investigation steps
37+
38+
**Validate the actor and request origin**
39+
- Review `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.access_key_id` to determine who initiated the deletion. Confirm whether the identity normally manages Route53 Resolver resources or VPC-level DNS configuration.
40+
- Examine `source.ip`, `source.address`, `source.geo` fields and `user_agent.original` to determine whether the request originated from an expected network path or automation role. Whether API calls were made via console, CLI, SDK, or custom tooling.
41+
42+
**Understand what was deleted and the impacted environment**
43+
- Inspect `aws.cloudtrail.request_parameters` and `aws.cloudtrail.response_elements` to identify the Query Log Configuration ID, Associated VPCs and destinations (e.g., CloudWatch Log Group, S3 bucket, Kinesis stream).
44+
- Determine whether these VPCs support production workloads, contain regulated or sensitive data, host internet-facing or privileged workloads (e.g., EKS clusters, directory services, bastion hosts).
45+
46+
**Correlate for intent and related activity**
47+
- Use `@timestamp` to correlate the deletion with:
48+
- Prior `PutResolverQueryLogConfig` or `AssociateResolverQueryLogConfig` modifications.
49+
- IAM permission changes or STS session activities.
50+
- Recent DNS anomalies if logs were active prior to deletion.
51+
- Pivot on the same `aws.cloudtrail.user_identity.arn` to identify:
52+
- Additional logging-related tampering (CloudTrail, VPC Flow Logs, S3 server access logs).
53+
- Resource isolation or privilege escalation attempts.
54+
- Suspicious EC2, Lambda, or container workload behavior.
55+
56+
**Validate operational context**
57+
- Check whether a change request, maintenance window, or migration task was underway that could explain the deletion.
58+
- Confirm with networking, SRE, or platform engineering teams whether a logging pipeline redesign was in progress, a deprecated log config was intentionally removed, infrastructure-as-code (IaC) automation recently applied updates that removed the configuration.
59+
60+
### False positive analysis
61+
62+
- **Legitimate network and logging redesign**
63+
- Deletions performed during planned VPC migrations, resolver logging pipeline upgrades, or CloudWatch/S3 restructuring may be benign.
64+
- **Expected IaC behavior**
65+
- Terraform, CloudFormation, or CDK stacks may destroy and recreate logging configurations during updates.
66+
Validate pipeline activity and automation roles to avoid noise.
67+
68+
### Response and remediation
69+
70+
**Contain and restore visibility**
71+
- If unauthorized activity is suspected:
72+
- Immediately re-create the Resolver Query Log Configuration.
73+
- Re-associate the configuration with the affected VPCs to restore DNS visibility.
74+
- Verify that CloudWatch Log Groups or S3 destinations have not been deleted or altered.
75+
76+
**Investigate access and scope of impact**
77+
- Review IAM permissions assigned to the actor:
78+
- Identify whether privilege escalation or role compromise occurred.
79+
- Validate that other high-impact logging or monitoring configurations (CloudTrail, VPC Flow Logs, GuardDuty) remain intact.
80+
- Perform a DNS-focused threat hunt:
81+
- Analyze prior logged queries for indicators of malware, C2 infrastructure, or suspicious domains before the logging gap.
82+
83+
**Strengthen defensive controls**
84+
- Restrict sensitive operations by:
85+
- Limiting `route53resolver:DeleteResolverQueryLogConfig` to a small number of privileged roles.
86+
- Adding IAM condition keys to constrain deletion operations by source IP, region, or principal ARN.
87+
- Enable AWS Config or Security Hub controls that:
88+
- Detect missing or deleted query log configurations.
89+
- Enforce continuous logging for critical VPCs.
90+
91+
### Additional information
92+
- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)**
93+
- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)**
94+
- **[AWS Knowledge Center – Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/)**
5895
"""
5996
references = [
6097
"https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_DeleteResolverQueryLogConfig.html",
@@ -66,7 +103,7 @@ tags = [
66103
"Domain: Cloud",
67104
"Data Source: AWS",
68105
"Data Source: Amazon Web Services",
69-
"Data Source: Amazon Route53",
106+
"Data Source: AWS Route 53",
70107
"Use Case: Log Auditing",
71108
"Resources: Investigation Guide",
72109
"Tactic: Defense Evasion",
@@ -75,8 +112,10 @@ timestamp_override = "event.ingested"
75112
type = "query"
76113

77114
query = '''
78-
event.dataset:aws.cloudtrail and event.provider: route53resolver.amazonaws.com
79-
and event.action: DeleteResolverQueryLogConfig and event.outcome: success
115+
event.dataset: aws.cloudtrail
116+
and event.provider: route53resolver.amazonaws.com
117+
and event.action: DeleteResolverQueryLogConfig
118+
and event.outcome: success
80119
'''
81120

82121

@@ -98,3 +137,21 @@ id = "TA0005"
98137
name = "Defense Evasion"
99138
reference = "https://attack.mitre.org/tactics/TA0005/"
100139

140+
[rule.investigation_fields]
141+
field_names = [
142+
"@timestamp",
143+
"user.name",
144+
"user_agent.original",
145+
"source.ip",
146+
"aws.cloudtrail.user_identity.arn",
147+
"aws.cloudtrail.user_identity.type",
148+
"aws.cloudtrail.user_identity.access_key_id",
149+
"target.entity.id",
150+
"event.action",
151+
"event.outcome",
152+
"cloud.account.id",
153+
"cloud.region",
154+
"aws.cloudtrail.request_parameters",
155+
"aws.cloudtrail.response_elements",
156+
]
157+

0 commit comments

Comments
 (0)