detection.wiki

Simple Queue Service

eventNameDescriptionSampleRule
anyCatch-all entry for Simple Queue Service rules that match the service but not a specific eventName.NN
PurgeQueueDeletes all messages in an SQS queue without deleting the queue itself.YY
AddPermissionAdds a permission to a queue for a specific principal.YN
CancelMessageMoveTaskCancels a specified message movement task.YN
ChangeMessageVisibilityChanges the visibility timeout of a specified message in a queue to a new value.NN
ChangeMessageVisibilityBatchChanges the visibility timeout of multiple messages.NN
CreateQueueCreates a new standard or FIFO queue.YN
DeleteMessageDeletes the specified message from the specified queue.NN
DeleteMessageBatchDeletes up to ten messages from the specified queue.NN
DeleteQueueDeletes the queue specified by the QueueUrl, regardless of the queue's contents.YN
GetQueueAttributesGets attributes for the specified queue.NN
GetQueueUrlThe GetQueueUrl API returns the URL of an existing Amazon SQS queue.NN
ListDeadLetterSourceQueuesReturns a list of your queues that have the RedrivePolicy queue attribute configured with a dead-letter queue.NN
ListMessageMoveTasksGets the most recent message movement tasks (up to 10) under a specific source queue.NN
ListQueuesReturns a list of your queues in the current region.NN
ListQueueTagsList all cost allocation tags added to the specified Amazon SQS queue.NN
ReceiveMessageRetrieves one or more messages (up to 10), from the specified queue.NN
RemovePermissionRevokes any permissions in the queue policy that matches the specified Label parameter.YN
SendMessageDelivers a message to the specified queue.NN
SendMessageBatchYou can use SendMessageBatch to send up to 10 messages to the specified queue by assigning either identical or different values to each message (or by not assigning values at all).NN
SetQueueAttributesSets the value of one or more queue attributes, like a policy.YN
StartMessageMoveTaskStarts an asynchronous task to move messages from a specified source queue to a specified destination queue.YN
TagQueueAdd cost allocation tags to the specified Amazon SQS queue.YN
UntagQueueRemove cost allocation tags from the specified Amazon SQS queue.YN

any: Simple Queue Service (catch-all)

#
Service
sqs

Description

Catch-all entry for Simple Queue Service rules that match the service but not a specific eventName.

PurgeQueue

#
Service
sqs

Description

Deletes all messages in an SQS queue without deleting the queue itself.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "4393d12f-0938-45c6-983f-c0d1458eeee6",
  "eventName": "PurgeQueue",
  "eventSource": "sqs.amazonaws.com",
  "eventTime": "2026-06-29T19:11:56Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "7e82f63b-15d0-50f3-8359-9487d06c74ee",
  "requestParameters": {
    "queueUrl": "https://sqs.us-west-1.amazonaws.com/123456789012/dwfix-q"
  },
  "resources": [
    {
      "ARN": "arn:aws:sqs:us-west-1:123456789012:dwfix-q",
      "accountId": "123456789012",
      "type": "AWS::SQS::Queue"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sqs.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • AWS SQS Queue Purge source medium: Identifies when an AWS Simple Queue Service (SQS) queue is purged. Purging an SQS queue permanently deletes all messages currently in the queue. Adversaries may use this action to disrupt application workflows, destroy operational data, or impair monitoring and alerting by removing messages that contain evidence of malicious activity.T1485, T1562, T1562.008

AddPermission

#
Service
sqs

Description

Adds a permission to a queue for a specific principal.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "9e003234-f7a3-4413-b00e-cec420b6046a",
  "eventName": "AddPermission",
  "eventSource": "sqs.amazonaws.com",
  "eventTime": "2026-06-29T19:11:56Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "3f417682-f391-5ff1-a74f-143e362d5bec",
  "requestParameters": {
    "aWSAccountIds": [
      "123456789012"
    ],
    "actions": [
      "SendMessage"
    ],
    "label": "dw",
    "queueUrl": "https://sqs.us-west-1.amazonaws.com/123456789012/dwfix-q"
  },
  "resources": [
    {
      "ARN": "arn:aws:sqs:us-west-1:123456789012:dwfix-q",
      "accountId": "123456789012",
      "type": "AWS::SQS::Queue"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sqs.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CancelMessageMoveTask

#
Service
sqs

Description

Cancels a specified message movement task.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "903d76cb-07cd-4d7d-b371-a3cc5d81c039",
  "eventName": "CancelMessageMoveTask",
  "eventSource": "sqs.amazonaws.com",
  "eventTime": "2026-06-29T20:58:47Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "84b8b046-ec83-567a-b446-d2fa3244bc06",
  "requestParameters": {
    "taskHandle": "eyJ0YXNrSWQiOiJhOWQ2ZWM2Zi0yZjAxLTQyZDctYTdjNS05M2RlMWNlNWMwZjYiLCJzb3VyY2VBcm4iOiJhcm46YXdzOnNxczp1cy13ZXN0LTE6OTM3MDgzMTgwMjU5OmR3Zml4LXNxcy1kbHEtNzI5N2VhNWMifQ=="
  },
  "responseElements": {
    "approximateNumberOfMessagesMoved": 0
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sqs.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,b,n,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ChangeMessageVisibility

#
Service
sqs

Description

Changes the visibility timeout of a specified message in a queue to a new value.

ChangeMessageVisibilityBatch

#
Service
sqs

Description

Changes the visibility timeout of multiple messages.

CreateQueue

#
Service
sqs

Description

Creates a new standard or FIFO queue.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sqs:createqueue on resource: arn:aws:sqs:us-east-1:811596193553:test-boto3-2017-03-15T17-11-49-50913",
  "eventID": "3f710f0f-ddc0-47e9-b792-3769a37e2024",
  "eventName": "CreateQueue",
  "eventSource": "sqs.amazonaws.com",
  "eventTime": "2017-03-16T00:11:50Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.04",
  "recipientAccountId": "811596193553",
  "requestID": "7b5cd728-477c-52e8-9824-866b9dfaaeb6",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "55.170.118.2",
  "userAgent": "Boto3/1.3.1 Python/2.7.3 Linux/3.2.0-119-generic Botocore/1.4.13 Resource",
  "userIdentity": {
    "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/backup",
    "principalId": "AIDA9BO36HFBHKGJAO9C1",
    "type": "IAMUser",
    "userName": "backup"
  }
}

References #

DeleteMessage

#
Service
sqs

Description

Deletes the specified message from the specified queue.

DeleteMessageBatch

#
Service
sqs

Description

Deletes up to ten messages from the specified queue.

DeleteQueue

#
Service
sqs

Description

Deletes the queue specified by the QueueUrl, regardless of the queue's contents.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "a6399662-4d84-4b64-a3d4-742b08041ec7",
  "eventName": "DeleteQueue",
  "eventSource": "sqs.amazonaws.com",
  "eventTime": "2026-06-29T19:11:56Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "eeeac0fa-32e9-58a3-a93e-a246f7555cbe",
  "requestParameters": {
    "queueUrl": "https://sqs.us-west-1.amazonaws.com/123456789012/dwfix-q"
  },
  "resources": [
    {
      "ARN": "arn:aws:sqs:us-west-1:123456789012:dwfix-q",
      "accountId": "123456789012",
      "type": "AWS::SQS::Queue"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sqs.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetQueueAttributes

#
Service
sqs

Description

Gets attributes for the specified queue.

GetQueueUrl

#
Service
sqs

Description

The GetQueueUrl API returns the URL of an existing Amazon SQS queue.

ListDeadLetterSourceQueues

#
Service
sqs

Description

Returns a list of your queues that have the RedrivePolicy queue attribute configured with a dead-letter queue.

ListMessageMoveTasks

#
Service
sqs

Description

Gets the most recent message movement tasks (up to 10) under a specific source queue.

ListQueues

#
Service
sqs

Description

Returns a list of your queues in the current region.

ListQueueTags

#
Service
sqs

Description

List all cost allocation tags added to the specified Amazon SQS queue.

ReceiveMessage

#
Service
sqs

Description

Retrieves one or more messages (up to 10), from the specified queue.

RemovePermission

#
Service
sqs

Description

Revokes any permissions in the queue policy that matches the specified Label parameter.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "aa4dd4a1-619b-4506-aa97-c4aea459c75a",
  "eventName": "RemovePermission",
  "eventSource": "sqs.amazonaws.com",
  "eventTime": "2026-06-29T19:11:56Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "816c91b8-2c7c-500b-8e7c-f304e9c0b416",
  "requestParameters": {
    "label": "dw",
    "queueUrl": "https://sqs.us-west-1.amazonaws.com/123456789012/dwfix-q"
  },
  "resources": [
    {
      "ARN": "arn:aws:sqs:us-west-1:123456789012:dwfix-q",
      "accountId": "123456789012",
      "type": "AWS::SQS::Queue"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sqs.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

SendMessage

#
Service
sqs

Description

Delivers a message to the specified queue.

SendMessageBatch

#
Service
sqs

Description

You can use SendMessageBatch to send up to 10 messages to the specified queue by assigning either identical or different values to each message (or by not assigning values at all).

SetQueueAttributes

#
Service
sqs

Description

Sets the value of one or more queue attributes, like a policy.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "42516a61-f5f4-4f0e-9e7c-88894d49b54e",
  "eventName": "SetQueueAttributes",
  "eventSource": "sqs.amazonaws.com",
  "eventTime": "2026-06-29T19:11:56Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "a292e47e-00be-507e-837b-86c2c5022463",
  "requestParameters": {
    "attributes": {
      "DelaySeconds": "1"
    },
    "queueUrl": "https://sqs.us-west-1.amazonaws.com/123456789012/dwfix-q"
  },
  "resources": [
    {
      "ARN": "arn:aws:sqs:us-west-1:123456789012:dwfix-q",
      "accountId": "123456789012",
      "type": "AWS::SQS::Queue"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sqs.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

StartMessageMoveTask

#
Service
sqs

Description

Starts an asynchronous task to move messages from a specified source queue to a specified destination queue.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "63bae262-4e72-463d-bcb4-6d8236ed5525",
  "eventName": "StartMessageMoveTask",
  "eventSource": "sqs.amazonaws.com",
  "eventTime": "2026-06-29T20:58:47Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "610f387d-54f9-5b49-9ffe-5ac18a3e4135",
  "requestParameters": {
    "destinationArn": "arn:aws:sqs:us-west-1:123456789012:dwfix-sqs-src-7297ea5c",
    "maxNumberOfMessagesPerSecond": 1,
    "sourceArn": "arn:aws:sqs:us-west-1:123456789012:dwfix-sqs-dlq-7297ea5c"
  },
  "responseElements": {
    "taskHandle": "eyJ0YXNrSWQiOiJhOWQ2ZWM2Zi0yZjAxLTQyZDctYTdjNS05M2RlMWNlNWMwZjYiLCJzb3VyY2VBcm4iOiJhcm46YXdzOnNxczp1cy13ZXN0LTE6OTM3MDgzMTgwMjU5OmR3Zml4LXNxcy1kbHEtNzI5N2VhNWMifQ=="
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sqs.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,b,n,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

TagQueue

#
Service
sqs

Description

Add cost allocation tags to the specified Amazon SQS queue.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "e52085f7-63df-443e-a407-e4177db25d82",
  "eventName": "TagQueue",
  "eventSource": "sqs.amazonaws.com",
  "eventTime": "2026-06-29T19:11:56Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "ca233844-fb9f-54be-885e-5af83e23e0a3",
  "requestParameters": {
    "queueUrl": "https://sqs.us-west-1.amazonaws.com/123456789012/dwfix-q",
    "tags": {
      "dw": "f"
    }
  },
  "resources": [
    {
      "ARN": "arn:aws:sqs:us-west-1:123456789012:dwfix-q",
      "accountId": "123456789012",
      "type": "AWS::SQS::Queue"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sqs.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UntagQueue

#
Service
sqs

Description

Remove cost allocation tags from the specified Amazon SQS queue.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "dee66279-7035-49da-bf3e-a2174aa4dc82",
  "eventName": "UntagQueue",
  "eventSource": "sqs.amazonaws.com",
  "eventTime": "2026-06-29T19:11:56Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "c6e934ac-f710-5105-89ef-561032acf518",
  "requestParameters": {
    "queueUrl": "https://sqs.us-west-1.amazonaws.com/123456789012/dwfix-q",
    "tagKeys": [
      "dw"
    ]
  },
  "resources": [
    {
      "ARN": "arn:aws:sqs:us-west-1:123456789012:dwfix-q",
      "accountId": "123456789012",
      "type": "AWS::SQS::Queue"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sqs.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}