Attempt To Delete A CloudTrail Log

Status: test
Severity: medium
Log source: product aws, service cloudtrail
Author: Zach Mathis (@yamatosecurity)
Source: github.com/Yamato-Security/suzaku-rules

A attacker may have attempted to delete a CloudTrail log but it was denied due to a lack of permissions. Sample command line: aws cloudtrail delete-trail --name TrailName

Known false positives

Admins trying to delete unneeded logs but lacked permissions.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685.002` Disable or Modify Tools: Disable or Modify Cloud Log

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `DeleteTrail`: Deletes a CloudTrail trail, permanently stopping the delivery of log files for that trail to its configured S3 bucket.

Rules detecting the same action

These rules filter on the same operation.

AWS CloudTrail Important Change (Sigma)
AWS CloudTrail Log Deleted (Elastic)
AWS Defense Evasion Delete Cloudtrail (Splunk)
CloudTrail Log Deleted (Sigma)

Rule body

title: Attempt To Delete A CloudTrail Log
id: b6f02c52-1158-4d31-98a8-a4751718f3db
status: test
description: |
    A attacker may have attempted to delete a CloudTrail log but it was denied due to a lack of permissions.
    Sample command line: aws cloudtrail delete-trail --name TrailName
references:
    - https://research.splunk.com/cloud/82092925-9ca1-4e06-98b8-85a2d3889552/
    - https://expel.com/blog/following-cloudtrail-generating-aws-security-signals-sumo-logic/
    - https://medium.com/daniel-grzelak/disrupting-aws-logging-a42e437d6594
    - https://traildiscover.cloud/#CloudTrail-DeleteTrail
author: Zach Mathis (@yamatosecurity)
date: 2025-04-23
modified: 2025-04-23
tags:
    - attack.defense-evasion
    - attack.t1562.008 # Impair Defenses: Disable or Modify Cloud Logs
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'cloudtrail.amazonaws.com'
        eventName: 'DeleteTrail'
        errorCode: 'AccessDenied'
    condition: selection
falsepositives:
    - Admins trying to delete unneeded logs but lacked permissions.
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    eventSource: 'cloudtrail.amazonaws.com'
    eventName: 'DeleteTrail'
    errorCode: 'AccessDenied'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`errorCode`	eq	`AccessDenied`	`field:"aws::errorCode" kind:eq value:"AccessDenied"`
`eventName`	eq	`DeleteTrail`	`field:"aws::eventName" kind:eq value:"DeleteTrail"`
`eventSource`	eq	`cloudtrail.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"cloudtrail.amazonaws.com"`