AWS VPC Flow Logs Deleted

Status: experimental
Severity: high
Log source: product aws, service cloudtrail
Author: Ivan Saakov
Source: github.com/SigmaHQ/sigma

Detects the deletion of one or more VPC Flow Logs in AWS Elastic Compute Cloud (EC2) through the DeleteFlowLogs API call. Adversaries may delete flow logs to evade detection or remove evidence of network activity, hindering forensic investigations and visibility into malicious operations.

Known false positives

During maintenance operations or testing, authorized administrators may delete VPC Flow Logs as part of routine network management or cleanup activities.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	No specific technique

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `DeleteFlowLogs`: Deletes one or more VPC flow logs.

Rules detecting the same action

These rules filter on the same operation.

Account Security Configuration Changed (Panther)
AWS VPC Flow Logs Removed (Panther)
AWSCloudTrail - Changes made to AWS CloudTrail logs (Kusto)
AWSCloudTrail - Config Service Resource Deletion Attempts (Kusto)
AWSCloudTrail - Tampering to AWS CloudTrail logs (Kusto)

Rule body

title: AWS VPC Flow Logs Deleted
id: e386b9b5-af12-450e-afff-761730fb8a98
status: experimental
description: |
    Detects the deletion of one or more VPC Flow Logs in AWS Elastic Compute Cloud (EC2) through the DeleteFlowLogs API call.
    Adversaries may delete flow logs to evade detection or remove evidence of network activity, hindering forensic investigations and visibility into malicious operations.
references:
    - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteFlowLogs.html
    - https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/delete-flow-logs.html
    - https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_ec2_flow_log_deletion
author: Ivan Saakov
date: 2025-10-19
tags:
    - attack.stealth
logsource:
    product: aws
    service: cloudtrail
detection:
    selection_event_name:
        eventName: 'DeleteFlowLogs'
    selection_status_success:
        errorCode: 'Success'
    selection_status_null:
        errorCode: null
    condition: selection_event_name and 1 of selection_status_*
falsepositives:
    - During maintenance operations or testing, authorized administrators may delete VPC Flow Logs as part of routine network management or cleanup activities.
level: high

Stages and Predicates

Stage 0: `condition`

selection_event_name and 1 of selection_status_*

Stage 1: `selection_event_name`

selection_event_name:
    eventName: 'DeleteFlowLogs'

Stage 2: `selection_status_success`

selection_status_success:
    errorCode: 'Success'

Stage 3: `selection_status_null`

selection_status_null:
    errorCode: null

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`errorCode`	eq	`Success`	`field:"aws::errorCode" kind:eq value:"Success"`
`errorCode`	is_null	(no value, null check)	`field:"aws::errorCode" kind:is_null`
`eventName`	eq	`DeleteFlowLogs`	`field:"aws::eventName" kind:eq value:"DeleteFlowLogs"`