huntrule

AWS CloudTrail: StopLogging, UpdateTrail, and DeleteTrail Changes

Detects CloudTrail stop, update, or delete actions that can impair logging and audit visibility.

FreeUnreviewedSigmamediumv1
title: "AWS CloudTrail: StopLogging, UpdateTrail, and DeleteTrail Changes"
id: 56b2ca4b-4a9e-4e15-80f3-b793856919ee
status: test
description: This rule flags CloudTrail actions that stop logging, modify trail configuration, or delete a trail. Such changes can reduce or eliminate audit visibility, making it valuable for an attacker attempting defense impairment. It relies on CloudTrail event telemetry matching eventSource cloudtrail.amazonaws.com with eventName StopLogging, UpdateTrail, or DeleteTrail.
references:
  - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_disable_logging.yml
author: vitaliy0x1, Huntrule Team
date: 2020-01-21
modified: 2022-10-09
tags:
  - attack.defense-impairment
  - attack.t1685.002
logsource:
  product: aws
  service: cloudtrail
detection:
  selection_source:
    eventSource: cloudtrail.amazonaws.com
    eventName:
      - StopLogging
      - UpdateTrail
      - DeleteTrail
  condition: selection_source
falsepositives:
  - Valid change in a Trail
level: medium
license: DRL-1.1
related:
  - id: 4db60cc0-36fb-42b7-9b58-a5b53019fb74
    type: derived

What it detects

This rule flags CloudTrail actions that stop logging, modify trail configuration, or delete a trail. Such changes can reduce or eliminate audit visibility, making it valuable for an attacker attempting defense impairment. It relies on CloudTrail event telemetry matching eventSource cloudtrail.amazonaws.com with eventName StopLogging, UpdateTrail, or DeleteTrail.

Known false positives

  • Valid change in a Trail

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.