AWS Config Service Modified, Stopped, or Deleted
This rule detects when an AWS Config Service is modified, stopped, or deleted. Specifically, it looks for CloudTrail events indicating actions such as stopping or deleting a configuration recorder, deleting a delivery channel, or putting (creating/updating) a delivery channel or configuration recorder. These actions can be indicative of an adversary attempting to impair defenses by disabling or modifying cloud logging capabilities.
YARA-L
