Detection rules › Sigma

AWS VPC Flow Logs Deleted

Status
experimental
Severity
high
Log source
product aws, service cloudtrail
Author
Ivan Saakov
Source
github.com/SigmaHQ/sigma

Detects the deletion of one or more VPC Flow Logs in AWS Elastic Compute Cloud (EC2) through the DeleteFlowLogs API call. Adversaries may delete flow logs to evade detection or remove evidence of network activity, hindering forensic investigations and visibility into malicious operations.

MITRE ATT&CK coverage

TacticTechniques
StealthNo specific technique

Rules detecting the same action

Other rules on this platform that filter on the same API call or operation.

Rule body yaml

title: AWS VPC Flow Logs Deleted
id: e386b9b5-af12-450e-afff-761730fb8a98
status: experimental
description: |
    Detects the deletion of one or more VPC Flow Logs in AWS Elastic Compute Cloud (EC2) through the DeleteFlowLogs API call.
    Adversaries may delete flow logs to evade detection or remove evidence of network activity, hindering forensic investigations and visibility into malicious operations.
references:
    - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteFlowLogs.html
    - https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/delete-flow-logs.html
    - https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_ec2_flow_log_deletion
author: Ivan Saakov
date: 2025-10-19
tags:
    - attack.stealth
logsource:
    product: aws
    service: cloudtrail
detection:
    selection_event_name:
        eventName: 'DeleteFlowLogs'
    selection_status_success:
        errorCode: 'Success'
    selection_status_null:
        errorCode: null
    condition: selection_event_name and 1 of selection_status_*
falsepositives:
    - During maintenance operations or testing, authorized administrators may delete VPC Flow Logs as part of routine network management or cleanup activities.
level: high

Stages and Predicates

Stage 0: condition

selection_event_name and 1 of selection_status_*

Stage 1: selection_event_name

selection_event_name:
    eventName: 'DeleteFlowLogs'

Stage 2: selection_status_success

selection_status_success:
    errorCode: 'Success'

Stage 3: selection_status_null

selection_status_null:
    errorCode: null

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
errorCodeeq
  • Success
errorCodeis_null
  • (no value, null check)
eventNameeq
  • DeleteFlowLogs