AWS CloudTrail logging disabled
AWS CloudTrail logging was stopped or a trail was deleted/reconfigured to narrow its scope.
What it detects
AWS CloudTrail logging was stopped or a trail was deleted/reconfigured to narrow its scope. Disabling cloud audit logging blinds the defender and is a classic anti-forensics step once an attacker has obtained privileged access to the control plane.
MITRE ATT&CK mapping
- T1562.008Impair Defenses: Disable or Modify Cloud Logs· Defense Evasion
False positives and triage
Trail changes can be part of legitimate account administration. Correlate with an approved change request and the identity that made the change; unplanned StopLogging/DeleteTrail should be treated as high priority.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 85%. Source: rules/cloud/aws_cloudtrail_logging_disabled.yaml, licensed under the Apache License 2.0.
id: cloud.aws.cloudtrail_logging_disabled
version: 1.0.0
status: stable
severity: high
confidence: 0.85
platforms: [application]
mitre_techniques: [T1562.008]
description: |
AWS CloudTrail logging was stopped or a trail was deleted/reconfigured to narrow its
scope. Disabling cloud audit logging blinds the defender and is a classic anti-forensics
step once an attacker has obtained privileged access to the control plane.
match:
provider: AWS
event_action_any:
- StopLogging
- DeleteTrail
- UpdateTrail
- PutEventSelectors
correlation_keys: [user_name]
false_positive_guidance: |
Trail changes can be part of legitimate account administration. Correlate with an
approved change request and the identity that made the change; unplanned
StopLogging/DeleteTrail should be treated as high priority.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.