[New Rule] Route53 Resolver Query Log Configuration Deleted #3592

terrancedejesus · 2024-04-12T19:37:08Z

Issues

https://github.com/elastic/ia-trade-team/issues/358

Summary

Identifies when a Route53 Resolver Query Log Configuration is deleted. When a Route53 a Resolver query log configuration
is deleted, Resolver stops logging DNS queries and responses for the specified configuration. Adversaries may delete
query log configurations to evade detection or cover their tracks.

Example Data

{
  "_index": ".ds-logs-aws.cloudtrail-default-2024.04.09-000001",
  "_id": "5d24df4f9c-000000036189",
  "_version": 1,
  "_score": 0,
  "_source": {
    "agent": {
      "name": "ip-172-31-95-103",
      "id": "f14d530d-b7f2-4dbd-b122-28582c2a767c",
      "ephemeral_id": "69b4fa20-756a-4d41-8325-7613b13a01b2",
      "type": "filebeat",
      "version": "8.13.2"
    },
    "log": {
      "file": {
        "path": "https://asperitas-security-logs.s3.us-east-1.amazonaws.com/AWSLogs/x/CloudTrail/us-east-1/2024/04/12/x_CloudTrail_us-east-1_20240412T1920Z_CRyKTy8faZ3SFPV3.json.gz"
      },
      "offset": 36189
    },
    "elastic_agent": {
      "id": "f14d530d-b7f2-4dbd-b122-28582c2a767c",
      "version": "8.13.2",
      "snapshot": false
    },
    "source": {
      "geo": {
        "region_iso_code": "US-OH",
        "continent_name": "North America",
        "city_name": "Massillon",
        "country_iso_code": "US",
        "country_name": "United States",
        "region_name": "Ohio",
        "location": {
          "lon": x,
          "lat": x
        }
      },
      "as": {
        "number": 12097,
        "organization": {
          "name": "MASSCOM"
        }
      },
      "address": "x",
      "ip": "x"
    },
    "tags": [
      "preserve_original_event",
      "forwarded",
      "aws-cloudtrail"
    ],
    "cloud": {
      "region": "us-east-1",
      "account": {
        "id": "x"
      }
    },
    "input": {
      "type": "aws-s3"
    },
    "@timestamp": "2024-04-12T19:12:35.000Z",
    "ecs": {
      "version": "8.0.0"
    },
    "related": {
      "user": [
        "stratus"
      ]
    },
    "data_stream": {
      "namespace": "default",
      "type": "logs",
      "dataset": "aws.cloudtrail"
    },
    "tls": {
      "cipher": "TLS_AES_128_GCM_SHA256",
      "client": {
        "server_name": "route53resolver.us-east-1.amazonaws.com"
      },
      "version": "1.3",
      "version_protocol": "tls"
    },
    "event": {
      "agent_id_status": "verified",
      "ingested": "2024-04-12T19:17:04Z",
      "original": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"IAMUser\",\"principalId\":\"x\",\"arn\":\"arn:aws:iam::x:user/stratus\",\"accountId\":\"x\",\"accessKeyId\":\"AKIA47CRWDCFXZ3V7UXR\",\"userName\":\"stratus\"},\"eventTime\":\"2024-04-12T19:12:35Z\",\"eventSource\":\"route53resolver.amazonaws.com\",\"eventName\":\"DeleteResolverQueryLogConfig\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"x\",\"userAgent\":\"stratus-red-team_8fff3498-d5a1-4c0d-8892-53e9a40c0412\",\"requestParameters\":{\"resolverQueryLogConfigId\":\"rqlc-c16d367ca46944b8\"},\"responseElements\":{\"resolverQueryLogConfig\":{\"id\":\"rqlc-c16d367ca46944b8\",\"ownerId\":\"x\",\"status\":\"DELETING\",\"shareStatus\":\"NOT_SHARED\",\"associationCount\":0,\"arn\":\"arn:aws:route53resolver:us-east-1:x:resolver-query-log-config/rqlc-c16d367ca46944b8\",\"name\":\"stratus-red-team-dns-delete-config-btwyrbrcdz\",\"destinationArn\":\"arn:aws:s3:::stratus-red-team-dns-delete-bucket-btwyrbrcdz\",\"creatorRequestId\":\"tf-r53-resolver-query-log-config-20240412191211003300000001\",\"creationTime\":\"2024-04-12T19:12:11.472605Z\"}},\"requestID\":\"e8728cad-8b5b-4c41-8ecb-44e02cabb6f7\",\"eventID\":\"de76bfdc-d6bd-4c60-a4df-839b2c24a943\",\"readOnly\":false,\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"recipientAccountId\":\"x\",\"eventCategory\":\"Management\",\"tlsDetails\":{\"tlsVersion\":\"TLSv1.3\",\"cipherSuite\":\"TLS_AES_128_GCM_SHA256\",\"clientProvidedHostHeader\":\"route53resolver.us-east-1.amazonaws.com\"}}",
      "provider": "route53resolver.amazonaws.com",
      "created": "2024-04-12T19:16:54.274Z",
      "kind": "event",
      "action": "DeleteResolverQueryLogConfig",
      "id": "de76bfdc-d6bd-4c60-a4df-839b2c24a943",
      "type": [
        "info"
      ],
      "dataset": "aws.cloudtrail",
      "outcome": "success"
    },
    "aws": {
      "s3": {
        "bucket": {
          "name": "asperitas-security-logs",
          "arn": "arn:aws:s3:::asperitas-security-logs"
        },
        "object": {
          "key": "AWSLogs/x/CloudTrail/us-east-1/2024/04/12/x_CloudTrail_us-east-1_20240412T1920Z_CRyKTy8faZ3SFPV3.json.gz"
        }
      },
      "cloudtrail": {
        "event_version": "1.08",
        "flattened": {
          "request_parameters": {
            "resolverQueryLogConfigId": "rqlc-c16d367ca46944b8"
          },
          "response_elements": {
            "resolverQueryLogConfig": {
              "creatorRequestId": "tf-r53-resolver-query-log-config-20240412191211003300000001",
              "creationTime": "2024-04-12T19:12:11.472605Z",
              "destinationArn": "arn:aws:s3:::stratus-red-team-dns-delete-bucket-btwyrbrcdz",
              "associationCount": 0,
              "name": "stratus-red-team-dns-delete-config-btwyrbrcdz",
              "id": "rqlc-c16d367ca46944b8",
              "ownerId": "x",
              "arn": "arn:aws:route53resolver:us-east-1:x:resolver-query-log-config/rqlc-c16d367ca46944b8",
              "status": "DELETING",
              "shareStatus": "NOT_SHARED"
            }
          }
        },
        "event_type": "AwsApiCall",
        "read_only": false,
        "user_identity": {
          "access_key_id": "AKIA47CRWDCFXZ3V7UXR",
          "type": "IAMUser",
          "arn": "arn:aws:iam::x:user/stratus"
        },
        "recipient_account_id": "x",
        "event_category": "Management",
        "request_parameters": "{resolverQueryLogConfigId=rqlc-c16d367ca46944b8}",
        "request_id": "e8728cad-8b5b-4c41-8ecb-44e02cabb6f7",
        "response_elements": "{resolverQueryLogConfig={creatorRequestId=tf-r53-resolver-query-log-config-20240412191211003300000001, creationTime=2024-04-12T19:12:11.472605Z, destinationArn=arn:aws:s3:::stratus-red-team-dns-delete-bucket-btwyrbrcdz, associationCount=0, name=stratus-red-team-dns-delete-config-btwyrbrcdz, id=rqlc-c16d367ca46944b8, ownerId=x, arn=arn:aws:route53resolver:us-east-1:x:resolver-query-log-config/rqlc-c16d367ca46944b8, status=DELETING, shareStatus=NOT_SHARED}}",
        "management_event": true
      }
    },
    "user": {
      "name": "stratus",
      "id": "x"
    },
    "user_agent": {
      "original": "stratus-red-team_8fff3498-d5a1-4c0d-8892-53e9a40c0412",
      "name": "Other",
      "device": {
        "name": "Other"
      }
    }
  },
  "fields": {
    "aws.cloudtrail.request_parameters.text": [
      "{resolverQueryLogConfigId=rqlc-c16d367ca46944b8}"
    ],
    "elastic_agent.version": [
      "8.13.2"
    ],
    "tls.version_protocol": [
      "tls"
    ],
    "user_agent.original.text": [
      "stratus-red-team_8fff3498-d5a1-4c0d-8892-53e9a40c0412"
    ],
    "aws.cloudtrail.flattened.response_elements": [
      {
        "resolverQueryLogConfig": {
          "creatorRequestId": "tf-r53-resolver-query-log-config-20240412191211003300000001",
          "creationTime": "2024-04-12T19:12:11.472605Z",
          "destinationArn": "arn:aws:s3:::stratus-red-team-dns-delete-bucket-btwyrbrcdz",
          "associationCount": 0,
          "name": "stratus-red-team-dns-delete-config-btwyrbrcdz",
          "id": "rqlc-c16d367ca46944b8",
          "ownerId": "x",
          "arn": "arn:aws:route53resolver:us-east-1:x:resolver-query-log-config/rqlc-c16d367ca46944b8",
          "status": "DELETING",
          "shareStatus": "NOT_SHARED"
        }
      }
    ],
    "aws.cloudtrail.response_elements": [
      "{resolverQueryLogConfig={creatorRequestId=tf-r53-resolver-query-log-config-20240412191211003300000001, creationTime=2024-04-12T19:12:11.472605Z, destinationArn=arn:aws:s3:::stratus-red-team-dns-delete-bucket-btwyrbrcdz, associationCount=0, name=stratus-red-team-dns-delete-config-btwyrbrcdz, id=rqlc-c16d367ca46944b8, ownerId=x, arn=arn:aws:route53resolver:us-east-1:x:resolver-query-log-config/rqlc-c16d367ca46944b8, status=DELETING, shareStatus=NOT_SHARED}}"
    ],
    "agent.name.text": [
      "ip-172-31-95-103"
    ],
    "source.geo.region_name": [
      "Ohio"
    ],
    "source.ip": [
      "x"
    ],
    "agent.name": [
      "ip-172-31-95-103"
    ],
    "event.agent_id_status": [
      "verified"
    ],
    "source.geo.region_iso_code": [
      "US-OH"
    ],
    "aws.cloudtrail.management_event": [
      "true"
    ],
    "event.kind": [
      "event"
    ],
    "aws.cloudtrail.user_identity.arn": [
      "arn:aws:iam::x:user/stratus"
    ],
    "event.outcome": [
      "success"
    ],
    "source.geo.city_name": [
      "Massillon"
    ],
    "tls.version": [
      "1.3"
    ],
    "user_agent.original": [
      "stratus-red-team_8fff3498-d5a1-4c0d-8892-53e9a40c0412"
    ],
    "event.original": [
      "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"IAMUser\",\"principalId\":\"x\",\"arn\":\"arn:aws:iam::x:user/stratus\",\"accountId\":\"x\",\"accessKeyId\":\"AKIA47CRWDCFXZ3V7UXR\",\"userName\":\"stratus\"},\"eventTime\":\"2024-04-12T19:12:35Z\",\"eventSource\":\"route53resolver.amazonaws.com\",\"eventName\":\"DeleteResolverQueryLogConfig\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"x\",\"userAgent\":\"stratus-red-team_8fff3498-d5a1-4c0d-8892-53e9a40c0412\",\"requestParameters\":{\"resolverQueryLogConfigId\":\"rqlc-c16d367ca46944b8\"},\"responseElements\":{\"resolverQueryLogConfig\":{\"id\":\"rqlc-c16d367ca46944b8\",\"ownerId\":\"x\",\"status\":\"DELETING\",\"shareStatus\":\"NOT_SHARED\",\"associationCount\":0,\"arn\":\"arn:aws:route53resolver:us-east-1:x:resolver-query-log-config/rqlc-c16d367ca46944b8\",\"name\":\"stratus-red-team-dns-delete-config-btwyrbrcdz\",\"destinationArn\":\"arn:aws:s3:::stratus-red-team-dns-delete-bucket-btwyrbrcdz\",\"creatorRequestId\":\"tf-r53-resolver-query-log-config-20240412191211003300000001\",\"creationTime\":\"2024-04-12T19:12:11.472605Z\"}},\"requestID\":\"e8728cad-8b5b-4c41-8ecb-44e02cabb6f7\",\"eventID\":\"de76bfdc-d6bd-4c60-a4df-839b2c24a943\",\"readOnly\":false,\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"recipientAccountId\":\"x\",\"eventCategory\":\"Management\",\"tlsDetails\":{\"tlsVersion\":\"TLSv1.3\",\"cipherSuite\":\"TLS_AES_128_GCM_SHA256\",\"clientProvidedHostHeader\":\"route53resolver.us-east-1.amazonaws.com\"}}"
    ],
    "cloud.region": [
      "us-east-1"
    ],
    "user.id": [
      "x"
    ],
    "input.type": [
      "aws-s3"
    ],
    "log.offset": [
      36189
    ],
    "user_agent.name": [
      "Other"
    ],
    "data_stream.type": [
      "logs"
    ],
    "related.user": [
      "stratus"
    ],
    "tags": [
      "preserve_original_event",
      "forwarded",
      "aws-cloudtrail"
    ],
    "event.provider": [
      "route53resolver.amazonaws.com"
    ],
    "agent.id": [
      "f14d530d-b7f2-4dbd-b122-28582c2a767c"
    ],
    "ecs.version": [
      "8.0.0"
    ],
    "event.created": [
      "2024-04-12T19:16:54.274Z"
    ],
    "aws.cloudtrail.event_version": [
      "1.08"
    ],
    "agent.version": [
      "8.13.2"
    ],
    "source.as.number": [
      12097
    ],
    "aws.cloudtrail.read_only": [
      false
    ],
    "aws.cloudtrail.event_category": [
      "Management"
    ],
    "aws.cloudtrail.user_identity.type": [
      "IAMUser"
    ],
    "aws.s3.bucket.arn": [
      "arn:aws:s3:::asperitas-security-logs"
    ],
    "aws.cloudtrail.recipient_account_id": [
      "x"
    ],
    "aws.cloudtrail.request_id": [
      "e8728cad-8b5b-4c41-8ecb-44e02cabb6f7"
    ],
    "tls.cipher": [
      "TLS_AES_128_GCM_SHA256"
    ],
    "user.name": [
      "stratus"
    ],
    "source.geo.location": [
      {
        "coordinates": [
          -81.4971,
          40.8133
        ],
        "type": "Point"
      }
    ],
    "source.address": [
      "x"
    ],
    "aws.cloudtrail.flattened.request_parameters": [
      {
        "resolverQueryLogConfigId": "rqlc-c16d367ca46944b8"
      }
    ],
    "agent.type": [
      "filebeat"
    ],
    "event.module": [
      "aws"
    ],
    "source.geo.country_iso_code": [
      "US"
    ],
    "aws.cloudtrail.response_elements.text": [
      "{resolverQueryLogConfig={creatorRequestId=tf-r53-resolver-query-log-config-20240412191211003300000001, creationTime=2024-04-12T19:12:11.472605Z, destinationArn=arn:aws:s3:::stratus-red-team-dns-delete-bucket-btwyrbrcdz, associationCount=0, name=stratus-red-team-dns-delete-config-btwyrbrcdz, id=rqlc-c16d367ca46944b8, ownerId=x, arn=arn:aws:route53resolver:us-east-1:x:resolver-query-log-config/rqlc-c16d367ca46944b8, status=DELETING, shareStatus=NOT_SHARED}}"
    ],
    "elastic_agent.snapshot": [
      false
    ],
    "aws.cloudtrail.event_type": [
      "AwsApiCall"
    ],
    "aws.s3.bucket.name": [
      "asperitas-security-logs"
    ],
    "source.as.organization.name.text": [
      "MASSCOM"
    ],
    "elastic_agent.id": [
      "f14d530d-b7f2-4dbd-b122-28582c2a767c"
    ],
    "data_stream.namespace": [
      "default"
    ],
    "source.as.organization.name": [
      "MASSCOM"
    ],
    "source.geo.continent_name": [
      "North America"
    ],
    "tls.client.server_name": [
      "route53resolver.us-east-1.amazonaws.com"
    ],
    "event.action": [
      "DeleteResolverQueryLogConfig"
    ],
    "event.ingested": [
      "2024-04-12T19:17:04.000Z"
    ],
    "@timestamp": [
      "2024-04-12T19:12:35.000Z"
    ],
    "cloud.account.id": [
      "x"
    ],
    "aws.cloudtrail.user_identity.access_key_id": [
      "AKIA47CRWDCFXZ3V7UXR"
    ],
    "data_stream.dataset": [
      "aws.cloudtrail"
    ],
    "event.type": [
      "info"
    ],
    "log.file.path": [
      "https://asperitas-security-logs.s3.us-east-1.amazonaws.com/AWSLogs/x/CloudTrail/us-east-1/2024/04/12/x_CloudTrail_us-east-1_20240412T1920Z_CRyKTy8faZ3SFPV3.json.gz"
    ],
    "agent.ephemeral_id": [
      "69b4fa20-756a-4d41-8325-7613b13a01b2"
    ],
    "aws.cloudtrail.request_parameters": [
      "{resolverQueryLogConfigId=rqlc-c16d367ca46944b8}"
    ],
    "event.id": [
      "de76bfdc-d6bd-4c60-a4df-839b2c24a943"
    ],
    "source.geo.country_name": [
      "United States"
    ],
    "user_agent.device.name": [
      "Other"
    ],
    "aws.s3.object.key": [
      "AWSLogs/x/CloudTrail/us-east-1/2024/04/12/x_CloudTrail_us-east-1_20240412T1920Z_CRyKTy8faZ3SFPV3.json.gz"
    ],
    "event.dataset": [
      "aws.cloudtrail"
    ],
    "user.name.text": [
      "stratus"
    ]
  }
}

Reference: https://docs.aws.amazon.com/Route53/latest/APIReference/API_DeleteQueryLoggingConfig.html

…eletion

rules/integrations/aws/defense_evasion_route53_dns_query_resolver_config_deletion.toml

…ver_config_deletion.toml Co-authored-by: Ruben Groenewoud <[email protected]>

…eletion

* new rule 'Route53 Resolver Query Log Configuration Deleted' * added investigation guide * adjusted investigation notes * Update rules/integrations/aws/defense_evasion_route53_dns_query_resolver_config_deletion.toml Co-authored-by: Ruben Groenewoud <[email protected]> --------- Co-authored-by: Ruben Groenewoud <[email protected]> (cherry picked from commit 2375297)

new rule 'Route53 Resolver Query Log Configuration Deleted'

d5d83a1

terrancedejesus added Integration: AWS AWS related rules Domain: Cloud Rule: New Proposal for new rule Area: RAD labels Apr 12, 2024

terrancedejesus self-assigned this Apr 12, 2024

terrancedejesus and others added 2 commits May 6, 2024 18:36

added investigation guide

3311d52

Merge branch 'main' into new-rule-route53-dns-query-resolver-config-d…

7dfd4df

…eletion

terrancedejesus marked this pull request as ready for review May 7, 2024 01:40

github-actions bot added the backport: auto label May 7, 2024

terrancedejesus requested review from w0rk3r, DefSecSentinel, imays11, Samirbous and Aegrah May 7, 2024 01:40

terrancedejesus and others added 3 commits May 6, 2024 18:41

adjusted investigation notes

071f91f

Merge branch 'main' into new-rule-route53-dns-query-resolver-config-d…

4625589

…eletion

Merge branch 'main' into new-rule-route53-dns-query-resolver-config-d…

aacac5b

…eletion

Aegrah approved these changes May 13, 2024

View reviewed changes

rules/integrations/aws/defense_evasion_route53_dns_query_resolver_config_deletion.toml Outdated Show resolved Hide resolved

rules/integrations/aws/defense_evasion_route53_dns_query_resolver_config_deletion.toml Show resolved Hide resolved

Samirbous approved these changes May 13, 2024

View reviewed changes

rules/integrations/aws/defense_evasion_route53_dns_query_resolver_config_deletion.toml Show resolved Hide resolved

terrancedejesus and others added 2 commits May 14, 2024 09:00

Update rules/integrations/aws/defense_evasion_route53_dns_query_resol…

ddfb3e6

…ver_config_deletion.toml Co-authored-by: Ruben Groenewoud <[email protected]>

Merge branch 'main' into new-rule-route53-dns-query-resolver-config-d…

bc63faf

…eletion

terrancedejesus merged commit 2375297 into main May 14, 2024
14 checks passed

terrancedejesus deleted the new-rule-route53-dns-query-resolver-config-deletion branch May 14, 2024 14:24

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[New Rule] Route53 Resolver Query Log Configuration Deleted #3592

[New Rule] Route53 Resolver Query Log Configuration Deleted #3592

terrancedejesus commented Apr 12, 2024 •

edited

Loading

[New Rule] Route53 Resolver Query Log Configuration Deleted #3592

[New Rule] Route53 Resolver Query Log Configuration Deleted #3592

Conversation

terrancedejesus commented Apr 12, 2024 • edited Loading

Issues

Summary

terrancedejesus commented Apr 12, 2024 •

edited

Loading