AWS Security Hub - Detect CloudTrail trails lacking KMS encryption

Status: available
Severity: medium
Time window: 1h
Group by: AwsAccountId, AwsRegion, AwsSecurityFindingDescription, AwsSecurityFindingId, AwsSecurityFindingTitle, ComplianceSecurityControlId, TrailId
Source: github.com/Azure/Azure-Sentinel

This query detects AWS CloudTrail trails that are not configured to use server-side encryption with a customer managed KMS key using AWS Security Hub control CloudTrail.2 findings. Unencrypted CloudTrail logs increase the risk of unauthorized access to sensitive audit data at rest.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685.002` Disable or Modify Tools: Disable or Modify Cloud Log
Impact	`T1565.001` Data Manipulation: Stored Data Manipulation

Rule body

id: 9c2f6c3b-7fd8-4c5a-9d9d-3c4f9e6a7b21
name: AWS Security Hub - Detect CloudTrail trails lacking KMS encryption
description: |
  This query detects AWS CloudTrail trails that are not configured to use server-side encryption with a customer managed KMS key using AWS Security Hub control CloudTrail.2 findings. 
  Unencrypted CloudTrail logs increase the risk of unauthorized access to sensitive audit data at rest.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: AWSSecurityHub
    dataTypes:
      - AWSSecurityHubFindings
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Impact
  - DefenseEvasion
relevantTechniques:
  - T1565.001
  - T1562.008
tags:
  - CIS AWS Foundations Benchmark v1.4.0
  - CIS AWS Foundations Benchmark v1.2.0
  - NIST 800-53 r5
  - PCI DSS v3.2.1
query: |
  AWSSecurityHubFindings
  | where RecordState == "ACTIVE" and ComplianceStatus == "FAILED"
  | where tostring(AwsSecurityFindingGeneratorId) == "security-control/CloudTrail.2"
    or tostring(ComplianceSecurityControlId) == "CloudTrail.2"
  | mv-expand Resource = Resources
  | where tostring(Resource.Type) == "AwsCloudTrailTrail"
  | extend TrailId = tostring(Resource.Id)
  | summarize TimeGenerated = max(TimeGenerated)
      by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription,
         AwsSecurityFindingId, ComplianceSecurityControlId, TrailId
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AwsAccountId
      - identifier: CloudAppAccountId
        columnName: AwsAccountId
  - entityType: CloudApplication
    fieldMappings:
      - identifier: Name
        columnName: TrailId
customDetails:
  ComplianceControlId: ComplianceSecurityControlId
  Region: AwsRegion
  FindingId: AwsSecurityFindingId
alertDetailsOverride:
  alertDisplayNameFormat: "AWS CloudTrail trail {{TrailId}} lacks KMS encryption"
  alertDescriptionFormat: "AWS CloudTrail trail ({{TrailId}}) lacks customer-managed KMS encryption for Account {{AwsAccountId}}."
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

AWSSecurityHubFindings

Stage 2: `where`

| where RecordState == "ACTIVE" and ComplianceStatus == "FAILED"

Stage 3: `where`

| where tostring(AwsSecurityFindingGeneratorId) == "security-control/CloudTrail.2"
  or tostring(ComplianceSecurityControlId) == "CloudTrail.2"

Stage 4: `mv-expand`

| mv-expand Resource = Resources

Stage 5: `where`

| where tostring(Resource.Type) == "AwsCloudTrailTrail"

Stage 6: `extend`

| extend TrailId = tostring(Resource.Id)

Stage 7: `summarize`

| summarize TimeGenerated = max(TimeGenerated)
    by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription,
       AwsSecurityFindingId, ComplianceSecurityControlId, TrailId

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AwsSecurityFindingGeneratorId`	eq	`security-control/CloudTrail.2` transforms: `tostring`	`field:"AwsSecurityFindingGeneratorId" kind:eq value:"security-control/CloudTrail.2"`
`ComplianceSecurityControlId`	eq	`CloudTrail.2` transforms: `tostring`	`field:"ComplianceSecurityControlId" kind:eq value:"CloudTrail.2"`
`ComplianceStatus`	eq	`FAILED`	`field:"ComplianceStatus" kind:eq value:"FAILED"`
`RecordState`	eq	`ACTIVE`	`field:"RecordState" kind:eq value:"ACTIVE"`
`Type`	eq	`AwsCloudTrailTrail` transforms: `tostring`	`field:"Type" kind:eq value:"AwsCloudTrailTrail"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AwsAccountId`	`summarize`
`AwsRegion`	`summarize`
`AwsSecurityFindingDescription`	`summarize`
`AwsSecurityFindingId`	`summarize`
`AwsSecurityFindingTitle`	`summarize`
`ComplianceSecurityControlId`	`summarize`
`TimeGenerated`	`summarize`
`TrailId`	`summarize`

AWS Security Hub - Detect CloudTrail trails lacking KMS encryption

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: mv-expand

Stage 5: where

Stage 6: extend

Stage 7: summarize