AWS SQS Queue Purge

Last updated 22 days ago on 2026-01-16

Created a year ago on 2025-01-08

About

Identifies when an AWS Simple Queue Service (SQS) queue is purged. Purging an SQS queue permanently deletes all messages currently in the queue. Adversaries may use this action to disrupt application workflows, destroy operational data, or impair monitoring and alerting by removing messages that contain evidence of malicious activity.

Tags

Domain: CloudData Source: AWSData Source: Amazon Web ServicesData Source: AWS SQSUse Case: Threat DetectionUse Case: Log AuditingTactic: Defense EvasionLanguage: kuery

Severity

medium

Risk Score

MITRE ATT&CK™

Defense Evasion (TA0005)(external, opens in a new tab or window)

↳ Impair Defenses (T1562)(external, opens in a new tab or window)

False Positive Examples

Authorized administrators or automated workflows may purge SQS queues for legitimate operational reasons, such as clearing stale messages, resetting test environments, or performing approved maintenance. Verify that the action aligns with documented procedures and expected operational behavior.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: Query (Kibana Query Language)
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: filebeat-*logs-aws.cloudtrail-*
Related Integrations: aws(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗event.dataset: "aws.cloudtrail"
    and event.provider: "sqs.amazonaws.com"
    and event.action: "PurgeQueue"
    and event.outcome: "success"

Install detection rules in Elastic Security

Detect AWS SQS Queue Purge in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).