File tree 2 files changed +4
-4
lines changed
docs/attack-techniques/AWS
v2/internal/attacktechniques/aws/defense-evasion/dns-delete-logs
2 files changed +4
-4
lines changed Original file line number Diff line number Diff line change @@ -25,7 +25,7 @@ Deletes a Route53 DNS Resolver query logging configuration. Simulates an attacke
25
25
26
26
<span style =" font-variant : small-caps ;" >Detonation</span >:
27
27
28
- - Delete the DNS logging configuration using <code >route53: DeleteQueryLoggingConfig </code >.
28
+ - Delete the DNS logging configuration using <code >route53: DeleteResolverQueryLogConfig </code >.
29
29
30
30
## Instructions
31
31
@@ -35,6 +35,6 @@ stratus detonate aws.defense-evasion.dns-delete-logs
35
35
## Detection
36
36
37
37
38
- Identify when a DNS logging configuration is deleted, through CloudTrail's <code >DeleteQueryLoggingConfig </code > event.
38
+ Identify when a DNS logging configuration is deleted, through CloudTrail's <code >DeleteResolverQueryLogConfig </code > event.
39
39
40
40
Original file line number Diff line number Diff line change @@ -29,9 +29,9 @@ Warm-up:
29
29
30
30
Detonation:
31
31
32
- - Delete the DNS logging configuration using <code>route53:DeleteQueryLoggingConfig </code>.` ,
32
+ - Delete the DNS logging configuration using <code>route53:DeleteResolverQueryLogConfig </code>.` ,
33
33
Detection : `
34
- Identify when a DNS logging configuration is deleted, through CloudTrail's <code>DeleteQueryLoggingConfig </code> event.
34
+ Identify when a DNS logging configuration is deleted, through CloudTrail's <code>DeleteResolverQueryLogConfig </code> event.
35
35
` ,
36
36
IsIdempotent : false , // can't delete a DNS logging configuration twice
37
37
PrerequisitesTerraformCode : tf ,
You can’t perform that action at this time.
0 commit comments