AWS CloudTrail Management Events Disabled via PutEventSelectors

[metadata]
creation_date = "2026/07/13"
integration = ["aws"]
maturity = "production"
updated_date = "2026/07/13"

[rule]
author = ["Elastic"]
description = """
Detects CloudTrail PutEventSelectors calls where the legacy event selectors explicitly set includeManagementEvents to
false, disabling capture of all management API calls for that trail. Unlike StopLogging or DeleteTrail — which
leave an obvious trace of the trail being stopped or removed entirely — this technique leaves the trail appearing
active and healthy in the console while silently blinding defenders to subsequent IAM changes, credential operations,
and resource abuse. This technique is documented in Stratus Red Team as aws.defense-evasion.cloudtrail-event-selectors
and is a known pre-exfiltration step.
"""
false_positives = [
    """
    IaC pipelines setting event selectors during trail creation always set includeManagementEvents to true — the rule
    will not fire on those calls. The remaining FP vector is an administrator intentionally restricting a trail to
    data-events-only for cost reasons. Validate the caller, change management ticket, and confirm this is not a
    multi-region or organization-wide trail where the coverage impact would be severe.
    """,
]
from = "now-6m"
index = ["logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS CloudTrail Management Events Disabled via PutEventSelectors"
note = """## Triage and analysis

### Investigating AWS CloudTrail Management Events Disabled via PutEventSelectors

`PutEventSelectors` controls which CloudTrail events a trail captures. This rule fires when the
new event selectors explicitly set `includeManagementEvents` to `false` — disabling capture of
all management API calls for that trail while leaving it appearing active in the console. This is
a surgical evasion technique that does not trigger the existing `StopLogging` or `DeleteTrail`
alerts, and can persist silently for days before detection.

### Possible investigation steps

- **Confirm the intent**: `aws.cloudtrail.request_parameters` contains the full JSON of the new
  event selectors. The rule has already matched `includeManagementEvents: false`. Confirm whether
  ALL selectors have management events disabled or only some, and whether `ExcludeManagementEventSources`
  further filters specific services.

- **Check for other narrowing**: Also inspect `ReadWriteType` and `DataResources` in the same
  event — switching to `ReadOnly` or removing data event entries compounds the coverage gap.

- **Verify the caller**: `aws.cloudtrail.user_identity.arn` — IaC automation (Terraform,
  CloudFormation, CDK) uses AssumedRole/ASIA* credentials and legitimately sets management event
  selectors to `true` during trail creation. An AKIA* key or Root identity making this change
  outside of a deployment pipeline is high-confidence adversarial.

- **Check trail scope**: Was this a multi-region trail or organization-wide trail? Changes to
  broad-scope trails have the largest visibility impact.

- **Correlate activity**: Look for high-impact API calls in the 30–60 minutes following this
  event — particularly IAM changes, credential operations, or S3/KMS data access — that would
  now be invisible to the trail.

- **Prior access**: Check for `GetTrailStatus`, `GetEventSelectors`, or `DescribeTrails` calls
  from the same identity before this event, indicating reconnaissance of the trail configuration.

### Response and remediation

- Immediately call `PutEventSelectors` to restore `includeManagementEvents: true` on all selectors.
- Confirm that `GetTrailStatus` shows `IsLogging: true`.
- Review all API activity from the time the selectors were modified until detection using
  alternative sources (CloudWatch, other regional trails) for the gap window.
- Restrict `cloudtrail:PutEventSelectors` to break-glass roles and enforce via SCP.
"""
references = [
    "https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_PutEventSelectors.html",
    "https://stratus-red-team.cloud/attack-techniques/AWS/aws.defense-evasion.cloudtrail-event-selectors/",
    "https://attack.mitre.org/techniques/T1562/008/",
]
risk_score = 47
rule_id = "20b79388-3225-4a98-b19f-17de8feaa39c"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS CloudTrail",
    "Use Case: Log Auditing",
    "Tactic: Defense Evasion",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "cloudtrail.amazonaws.com"
    and event.action: "PutEventSelectors"
    and event.outcome: "success"
    and aws.cloudtrail.request_parameters: *includeManagementEvents*false*
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[rule.threat.technique.subtechnique]]
id = "T1562.008"
name = "Disable or Modify Cloud Logs"
reference = "https://attack.mitre.org/techniques/T1562/008/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.provider",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
]