AWS CloudTrail AWS-cloudtrail

8 operations, identified by eventName in the audit log.

eventName	Description
_catch_all	Catch-all entry for AWS-cloudtrail rules that match the service but not a specific eventName.
CreateTrail	Creates a CloudTrail trail that delivers log files recording API activity in the account to the specified Amazon S3 bucket.
DeleteTrail	Deletes a CloudTrail trail, permanently stopping the delivery of log files for that trail to its configured S3 bucket.
DescribeTrails	Returns metadata about one or more CloudTrail trails in the current region, including their ARNs, S3 destinations, and configuration settings.
LookupEvents	Searches CloudTrail management event records in the current region for events matching specified attribute filters such as event name, resource type, or username.
StopLogging	Suspends CloudTrail logging for a trail, halting the delivery of new log files while preserving the trail configuration.
UpdateTrail	Updates the settings of an existing CloudTrail trail, such as its S3 bucket, SNS topic, or log file validation configuration.
PutEventSelectors	Configures event selectors for a trail to specify which management and data events CloudTrail logs.

_catch_all: AWS-cloudtrail (catch-all)

Service: AWS-cloudtrail

Description

Catch-all entry for AWS-cloudtrail rules that match the service but not a specific eventName.

Fields #

Name	Description
`eventName`	The name of the API action that was called.
`eventSource`	The AWS service endpoint that received the request (e.g. iam.amazonaws.com).
`eventType`	CloudTrail event category: AwsApiCall, AwsConsoleSignIn, AwsConsoleAction, AwsServiceEvent, or AwsVpceEvents.
`userIdentity`	The IAM entity that made the request (type, principalId, arn, accountId, sessionContext).
`sourceIPAddress`	IP address of the caller, or the AWS service principal for service-initiated calls.
`awsRegion`	AWS Region the request was made to.
`requestParameters`	Parameters sent with the request. Shape is action-specific; null when none.
`responseElements`	Response elements. Shape is action-specific; null for reads or when absent.
`errorCode`	AWS service error code when the request failed. Absent on success.
`errorMessage`	Description of the error when errorCode is present.

CreateTrail

Service: AWS-cloudtrail

Description

Creates a CloudTrail trail that delivers log files recording API activity in the account to the specified Amazon S3 bucket.

Fields #

Name	Description
`eventName`	The name of the API action that was called.
`eventSource`	The AWS service endpoint that received the request (e.g. iam.amazonaws.com).
`eventType`	CloudTrail event category: AwsApiCall, AwsConsoleSignIn, AwsConsoleAction, AwsServiceEvent, or AwsVpceEvents.
`userIdentity`	The IAM entity that made the request (type, principalId, arn, accountId, sessionContext).
`sourceIPAddress`	IP address of the caller, or the AWS service principal for service-initiated calls.
`awsRegion`	AWS Region the request was made to.
`requestParameters`	Parameters sent with the request. Shape is action-specific; null when none.
`responseElements`	Response elements. Shape is action-specific; null for reads or when absent.
`errorCode`	AWS service error code when the request failed. Absent on success.
`errorMessage`	Description of the error when errorCode is present.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Provider_Name`	eq	`cloudtrail.amazonaws.com`	1 rule	elastic

Detection Rules #

View all rules referencing this event →

Elastic #

AWS CloudTrail Log Created source low: Detects creation of a new AWS CloudTrail trail via CreateTrail API. While legitimate during onboarding or auditing improvements, adversaries can create trails that write to attacker-controlled destinations, limit regions, or otherwise subvert monitoring objectives. New trails should be validated for destination ownership, encryption, multi-region coverage, and organizational scope.

DeleteTrail

Service: AWS-cloudtrail

Description

Deletes a CloudTrail trail, permanently stopping the delivery of log files for that trail to its configured S3 bucket.

Fields #

Name	Description
`eventName`	The name of the API action that was called.
`eventSource`	The AWS service endpoint that received the request (e.g. iam.amazonaws.com).
`eventType`	CloudTrail event category: AwsApiCall, AwsConsoleSignIn, AwsConsoleAction, AwsServiceEvent, or AwsVpceEvents.
`userIdentity`	The IAM entity that made the request (type, principalId, arn, accountId, sessionContext).
`sourceIPAddress`	IP address of the caller, or the AWS service principal for service-initiated calls.
`awsRegion`	AWS Region the request was made to.
`requestParameters`	Parameters sent with the request. Shape is action-specific; null when none.
`responseElements`	Response elements. Shape is action-specific; null for reads or when absent.
`errorCode`	AWS service error code when the request failed. Absent on success.
`errorMessage`	Description of the error when errorCode is present.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::eventName`	eq	`DeleteTrail`	4 rules	sigma, splunk
`aws::eventName`	eq	`StopLogging`	1 rule	sigma, splunk
`aws::eventName`	eq	`UpdateTrail`	1 rule	kusto, sigma, splunk
`aws::eventSource`	eq	`cloudtrail.amazonaws.com`	4 rules	sigma, splunk
`Provider_Name`	eq	`cloudtrail.amazonaws.com`	1 rule	elastic
`aws::errorCode`	eq	`AccessDenied`	1 rule	elastic, panther, sigma, splunk
`aws::errorCode`	eq	`success`	1 rule	splunk
`userAgent`	ne	`console.amazonaws.com`	1 rule	splunk

Detection Rules #

View all rules referencing this event →

Sigma #

AWS CloudTrail Important Change source medium: Detects disabling, deleting and updating of a Trail↳ also matches StopLogging, UpdateTrail
Attempt To Delete A CloudTrail Log source medium: A attacker may have attempted to delete a CloudTrail log but it was denied due to a lack of permissions. Sample command line: aws cloudtrail delete-trail --name TrailName
CloudTrail Log Deleted source medium: A user attempted to delete a CloudTrail log but it was denied due to a lack of permissions. Sample command line: aws cloudtrail delete-trail --name TrailName

Elastic #

AWS CloudTrail Log Deleted source medium: Detects deletion of an AWS CloudTrail trail via DeleteTrail API. Removing trails is a high-risk action that destroys an audit control plane and is frequently paired with other destructive or stealthy operations. Validate immediately and restore compliant logging.

Splunk #

AWS Defense Evasion Delete Cloudtrail source: The following analytic detects the deletion of AWS CloudTrail logs by identifying DeleteTrail events within CloudTrail logs. This detection leverages CloudTrail data to monitor for successful DeleteTrail actions, excluding those…

YARA-L #

AWS CloudTrail Logging Tampered source: Detects when CloudTrail logging is updated, stopped or deleted.↳ also matches StopLogging, UpdateTrail, PutEventSelectors

DescribeTrails

Service: AWS-cloudtrail

Description

Returns metadata about one or more CloudTrail trails in the current region, including their ARNs, S3 destinations, and configuration settings.

Fields #

Name	Description
`eventName`	The name of the API action that was called.
`eventSource`	The AWS service endpoint that received the request (e.g. iam.amazonaws.com).
`eventType`	CloudTrail event category: AwsApiCall, AwsConsoleSignIn, AwsConsoleAction, AwsServiceEvent, or AwsVpceEvents.
`userIdentity`	The IAM entity that made the request (type, principalId, arn, accountId, sessionContext).
`sourceIPAddress`	IP address of the caller, or the AWS service principal for service-initiated calls.
`awsRegion`	AWS Region the request was made to.
`requestParameters`	Parameters sent with the request. Shape is action-specific; null when none.
`responseElements`	Response elements. Shape is action-specific; null for reads or when absent.
`errorCode`	AWS service error code when the request failed. Absent on success.
`errorMessage`	Description of the error when errorCode is present.

LookupEvents

Service: AWS-cloudtrail

Description

Searches CloudTrail management event records in the current region for events matching specified attribute filters such as event name, resource type, or username.

Fields #

Name	Description
`eventName`	The name of the API action that was called.
`eventSource`	The AWS service endpoint that received the request (e.g. iam.amazonaws.com).
`eventType`	CloudTrail event category: AwsApiCall, AwsConsoleSignIn, AwsConsoleAction, AwsServiceEvent, or AwsVpceEvents.
`userIdentity`	The IAM entity that made the request (type, principalId, arn, accountId, sessionContext).
`sourceIPAddress`	IP address of the caller, or the AWS service principal for service-initiated calls.
`awsRegion`	AWS Region the request was made to.
`requestParameters`	Parameters sent with the request. Shape is action-specific; null when none.
`responseElements`	Response elements. Shape is action-specific; null for reads or when absent.
`errorCode`	AWS service error code when the request failed. Absent on success.
`errorMessage`	Description of the error when errorCode is present.

StopLogging

Service: AWS-cloudtrail

Description

Suspends CloudTrail logging for a trail, halting the delivery of new log files while preserving the trail configuration.

Fields #

Name	Description
`eventName`	The name of the API action that was called.
`eventSource`	The AWS service endpoint that received the request (e.g. iam.amazonaws.com).
`eventType`	CloudTrail event category: AwsApiCall, AwsConsoleSignIn, AwsConsoleAction, AwsServiceEvent, or AwsVpceEvents.
`userIdentity`	The IAM entity that made the request (type, principalId, arn, accountId, sessionContext).
`sourceIPAddress`	IP address of the caller, or the AWS service principal for service-initiated calls.
`awsRegion`	AWS Region the request was made to.
`requestParameters`	Parameters sent with the request. Shape is action-specific; null when none.
`responseElements`	Response elements. Shape is action-specific; null for reads or when absent.
`errorCode`	AWS service error code when the request failed. Absent on success.
`errorMessage`	Description of the error when errorCode is present.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::eventName`	eq	`StopLogging`	4 rules	sigma, splunk
`aws::eventName`	eq	`DeleteTrail`	1 rule	sigma, splunk
`aws::eventName`	eq	`UpdateTrail`	1 rule	kusto, sigma, splunk
`aws::eventSource`	eq	`cloudtrail.amazonaws.com`	4 rules	sigma, splunk
`Provider_Name`	eq	`cloudtrail.amazonaws.com`	1 rule	elastic
`aws::errorCode`	eq	`AccessDenied`	1 rule	elastic, panther, sigma, splunk
`aws::errorCode`	eq	`success`	1 rule	splunk
`userAgent`	ne	`console.amazonaws.com`	1 rule	splunk

Detection Rules #

View all rules referencing this event →

Sigma #

Attempt To Stop CloudTrail Logging source medium: A user attempted to disable CloudTrail logging but it was denied due to a lack of permissions. Sample command line: aws cloudtrail stop-logging --name TrailName
CloudTrail Logging Stopped source high: A user successfully disabled CloudTrail logging. Sample command line: aws cloudtrail stop-logging --name TrailName
AWS CloudTrail Important Change source medium: Detects disabling, deleting and updating of a Trail↳ also matches DeleteTrail, UpdateTrail

Elastic #

AWS CloudTrail Log Suspended source medium: Detects Cloudtrail logging suspension via StopLogging API. Stopping CloudTrail eliminates forward audit visibility and is a classic defense evasion step before sensitive changes or data theft. Investigate immediately and determine what occurred during the logging gap.

Splunk #

AWS Defense Evasion Stop Logging Cloudtrail source: The following analytic detects StopLogging events in AWS CloudTrail logs. It leverages CloudTrail event data to identify when logging is intentionally stopped, excluding console-based actions and focusing on successful attempts. This…

YARA-L #

AWS CloudTrail Logging Tampered source: Detects when CloudTrail logging is updated, stopped or deleted.↳ also matches DeleteTrail, UpdateTrail, PutEventSelectors

UpdateTrail

Service: AWS-cloudtrail

Description

Updates the settings of an existing CloudTrail trail, such as its S3 bucket, SNS topic, or log file validation configuration.

Fields #

Name	Description
`eventName`	The name of the API action that was called.
`eventSource`	The AWS service endpoint that received the request (e.g. iam.amazonaws.com).
`eventType`	CloudTrail event category: AwsApiCall, AwsConsoleSignIn, AwsConsoleAction, AwsServiceEvent, or AwsVpceEvents.
`userIdentity`	The IAM entity that made the request (type, principalId, arn, accountId, sessionContext).
`sourceIPAddress`	IP address of the caller, or the AWS service principal for service-initiated calls.
`awsRegion`	AWS Region the request was made to.
`requestParameters`	Parameters sent with the request. Shape is action-specific; null when none.
`responseElements`	Response elements. Shape is action-specific; null for reads or when absent.
`errorCode`	AWS service error code when the request failed. Absent on success.
`errorMessage`	Description of the error when errorCode is present.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::eventName`	eq	`UpdateTrail`	4 rules	kusto, sigma, splunk
`aws::eventName`	eq	`DeleteTrail`	1 rule	sigma, splunk
`aws::eventName`	eq	`StopLogging`	1 rule	sigma, splunk
`aws::eventSource`	eq	`cloudtrail.amazonaws.com`	4 rules	sigma, splunk
`Provider_Name`	eq	`cloudtrail.amazonaws.com`	1 rule	elastic
`aws::errorCode`	eq	`AccessDenied`	1 rule	elastic, panther, sigma, splunk
`aws::errorCode`	eq	`success`	1 rule	splunk
`userAgent`	ne	`console.amazonaws.com`	1 rule	splunk

Detection Rules #

View all rules referencing this event →

Sigma #

Attempt To Modify CloudTrail Log Settings source medium: An attacker may have attempted to modify CloudTrail log settings for anti-forensics but it was denied due to a lack of permissions. An attacker can use the update-trail command to disable multi-region logging, so their attacks do not get logged to the other regions. Ex: aws cloudtrail update-trail --name [my-trail] --no-is-multi-region-trail --no-include-global-service-events The attacker may also modify the settings so that the logs get encrypted with a key the attacker only has to prevent reading of the logs. The attacker may also redirect the logs to a S3 bucket they control.
CloudTrail Log Settings Modified source high: An attacker may have attempted to modify CloudTrail log settings for anti-forensics but it was denied due to a lack of permissions. An attacker can use the update-trail command to disable multi-region logging, so their attacks do not get logged to the other regions. Ex: aws cloudtrail update-trail --name [my-trail] --no-is-multi-region-trail --no-include-global-service-events The attacker may also modify the settings so that the logs get encrypted with a key the attacker only has to prevent reading of the logs. The attacker may also redirect the logs to a S3 bucket they control.
AWS CloudTrail Important Change source medium: Detects disabling, deleting and updating of a Trail↳ also matches DeleteTrail, StopLogging

Elastic #

AWS CloudTrail Log Updated source low: Detects updates to an existing CloudTrail trail via UpdateTrail API which may reduce visibility, change destinations, or weaken integrity (e.g., removing global events, moving the S3 destination, or disabling validation). Adversaries can modify trails to evade detection while maintaining a semblance of logging. Validate any configuration change against approved baselines.

Splunk #

AWS Defense Evasion Update Cloudtrail source: The following analytic detects UpdateTrail events in AWS CloudTrail logs. It identifies attempts to modify CloudTrail settings, potentially to evade logging. The detection leverages CloudTrail logs, focusing on UpdateTrail events where…

YARA-L #

AWS CloudTrail Logging Tampered source: Detects when CloudTrail logging is updated, stopped or deleted.↳ also matches DeleteTrail, StopLogging, PutEventSelectors

PutEventSelectors

Service: AWS-cloudtrail

Description

Configures event selectors for a trail to specify which management and data events CloudTrail logs.

Fields #

Name	Description
`eventName`	The name of the API action that was called.
`eventSource`	The AWS service endpoint that received the request (e.g. iam.amazonaws.com).
`eventType`	CloudTrail event category: AwsApiCall, AwsConsoleSignIn, AwsConsoleAction, AwsServiceEvent, or AwsVpceEvents.
`userIdentity`	The IAM entity that made the request (type, principalId, arn, accountId, sessionContext).
`sourceIPAddress`	IP address of the caller, or the AWS service principal for service-initiated calls.
`awsRegion`	AWS Region the request was made to.
`requestParameters`	Parameters sent with the request. Shape is action-specific; null when none.
`responseElements`	Response elements. Shape is action-specific; null for reads or when absent.
`errorCode`	AWS service error code when the request failed. Absent on success.
`errorMessage`	Description of the error when errorCode is present.

Detection Rules #

View all rules referencing this event →

YARA-L #

AWS CloudTrail Logging Tampered source: Detects when CloudTrail logging is updated, stopped or deleted.↳ also matches DeleteTrail, StopLogging, UpdateTrail

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)