Detection rules › Sigma
Attempt To Delete A CloudTrail Log
A attacker may have attempted to delete a CloudTrail log but it was denied due to a lack of permissions. Sample command line: aws cloudtrail delete-trail --name TrailName
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1562.008 Impair Defenses: Disable or Modify Cloud Logs |
Event coverage
| Provider | Event |
|---|---|
| AWS-cloudtrail | DeleteTrail |
Rules detecting the same action
Other rules on this platform that filter on the same API call or operation.
- AWS CloudTrail Important Change (Sigma)
- AWS CloudTrail Log Deleted (Elastic)
- AWS Defense Evasion Delete Cloudtrail (Splunk)
- CloudTrail Log Deleted (Sigma)
Rule body yaml
title: Attempt To Delete A CloudTrail Log
id: b6f02c52-1158-4d31-98a8-a4751718f3db
status: test
description: |
A attacker may have attempted to delete a CloudTrail log but it was denied due to a lack of permissions.
Sample command line: aws cloudtrail delete-trail --name TrailName
references:
- https://research.splunk.com/cloud/82092925-9ca1-4e06-98b8-85a2d3889552/
- https://expel.com/blog/following-cloudtrail-generating-aws-security-signals-sumo-logic/
- https://medium.com/daniel-grzelak/disrupting-aws-logging-a42e437d6594
- https://traildiscover.cloud/#CloudTrail-DeleteTrail
author: Zach Mathis (@yamatosecurity)
date: 2025-04-23
modified: 2025-04-23
tags:
- attack.defense-evasion
- attack.t1562.008 # Impair Defenses: Disable or Modify Cloud Logs
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: 'cloudtrail.amazonaws.com'
eventName: 'DeleteTrail'
errorCode: 'AccessDenied'
condition: selection
falsepositives:
- Admins trying to delete unneeded logs but lacked permissions.
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
eventSource: 'cloudtrail.amazonaws.com'
eventName: 'DeleteTrail'
errorCode: 'AccessDenied'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
errorCode | eq |
|
eventName | eq |
|
eventSource | eq |
|