Attempt To Modify CloudTrail Log Settings

Status: test
Severity: medium
Log source: product aws, service cloudtrail
Author: Zach Mathis (@yamatosecurity)
Source: github.com/Yamato-Security/suzaku-rules

An attacker may have attempted to modify CloudTrail log settings for anti-forensics but it was denied due to a lack of permissions. An attacker can use the update-trail command to disable multi-region logging, so their attacks do not get logged to the other regions. Ex: aws cloudtrail update-trail --name [my-trail] --no-is-multi-region-trail --no-include-global-service-events The attacker may also modify the settings so that the logs get encrypted with a key the attacker only has to prevent reading of the logs. The attacker may also redirect the logs to a S3 bucket they control.

Known false positives

Admins trying to modify log settings but lacked permissions.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685.002` Disable or Modify Tools: Disable or Modify Cloud Log

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `UpdateTrail`: Updates the settings of an existing CloudTrail trail, such as its S3 bucket, SNS topic, or log file validation configuration.

Rules detecting the same action

These rules filter on the same operation.

AWS CloudTrail Important Change (Sigma)
AWS CloudTrail Log Updated (Elastic)
AWS Defense Evasion Update Cloudtrail (Splunk)
CloudTrail Log Settings Modified (Sigma)

Rule body

title: Attempt To Modify CloudTrail Log Settings
id: 0f11648b-4759-4491-9ff0-e61a28010bfd
status: test
description: |
    An attacker may have attempted to modify CloudTrail log settings for anti-forensics but it was denied due to a lack of permissions.
    An attacker can use the `update-trail` command to disable multi-region logging, so their attacks do not get logged to the other regions.
    Ex: `aws cloudtrail update-trail --name [my-trail] --no-is-multi-region-trail --no-include-global-service-events`
    The attacker may also modify the settings so that the logs get encrypted with a key the attacker only has to prevent reading of the logs.
    The attacker may also redirect the logs to a S3 bucket they control.
references:
    - https://medium.com/daniel-grzelak/disrupting-aws-logging-a42e437d6594
    - https://logrhythm.com/blog/aws-defense-evasion-and-centralized-multi-account-logging/
    - https://traildiscover.cloud/#CloudTrail-UpdateTrail
author: Zach Mathis (@yamatosecurity)
date: 2025-04-23
modified: 2025-04-23
tags:
    - attack.defense-evasion
    - attack.t1562.008 # Impair Defenses: Disable or Modify Cloud Logs
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'cloudtrail.amazonaws.com'
        eventName: 'UpdateTrail'
        errorCode: 'AccessDenied'
    condition: selection
falsepositives:
    - Admins trying to modify log settings but lacked permissions.
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    eventSource: 'cloudtrail.amazonaws.com'
    eventName: 'UpdateTrail'
    errorCode: 'AccessDenied'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`errorCode`	eq	`AccessDenied`	`field:"aws::errorCode" kind:eq value:"AccessDenied"`
`eventName`	eq	`UpdateTrail`	`field:"aws::eventName" kind:eq value:"UpdateTrail"`
`eventSource`	eq	`cloudtrail.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"cloudtrail.amazonaws.com"`