huntrule

AWS CloudTrail Trail Stop/Update/Delete Activity

Detects CloudTrail stop, update, or delete actions that can impair logging and audit visibility.

FreeReviewedSigma · Medium · v5
Product
aws
Service
cloudtrail
Author
vitaliy0x1 (SigmaHQ), DRL 1.1
Published
2020-01-21
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags CloudTrail control-plane events that stop logging, update an existing trail, or delete a trail. Attackers often target these actions to impair audit visibility, disrupt monitoring, or alter what data is recorded. Detection relies on AWS CloudTrail event fields indicating eventSource and matching the eventName values for StopLogging, UpdateTrail, or DeleteTrail.

Reporting behind it

Related detections7 linkedT1685.002 — drag to rearrange
Suspicious AWS GuardDuty Detector Tampering
Suspicious CloudTrail Logging Tampering for Defense Evasion (via aws)
Malicious Mailbox Audit Bypass Association in Exchange Online (via exchange)
Suspicious AWS CloudTrail Logging Disabled
Suspicious GCP Log Sink Tampering for Defense Evasion (via gcp)
AWS CloudTrail GuardDuty Detector Deleted or Disabled via UpdateDetector
AWS CloudTrail: AWS Config Delivery Channel/Recorder Disabled
AWS CloudTrail Trail Stop/Update/Delete Activity
Pivot detection · T1685.002 · 7 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.