Detection rules › Sigma
CloudTrail Log Settings Modified
An attacker may have attempted to modify CloudTrail log settings for anti-forensics but it was denied due to a lack of permissions. An attacker can use the update-trail command to disable multi-region logging, so their attacks do not get logged to the other regions. Ex: aws cloudtrail update-trail --name [my-trail] --no-is-multi-region-trail --no-include-global-service-events The attacker may also modify the settings so that the logs get encrypted with a key the attacker only has to prevent reading of the logs. The attacker may also redirect the logs to a S3 bucket they control.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1562.008 Impair Defenses: Disable or Modify Cloud Logs |
Event coverage
| Provider | Event |
|---|---|
| AWS-cloudtrail | UpdateTrail |
Rules detecting the same action
Other rules on this platform that filter on the same API call or operation.
- Attempt To Modify CloudTrail Log Settings (Sigma)
- AWS CloudTrail Important Change (Sigma)
- AWS CloudTrail Log Updated (Elastic)
- AWS Defense Evasion Update Cloudtrail (Splunk)
Rule body yaml
title: CloudTrail Log Settings Modified
id: 295b96b0-3345-4856-bd2f-2ca61ec89add
status: test
description: |
An attacker may have attempted to modify CloudTrail log settings for anti-forensics but it was denied due to a lack of permissions.
An attacker can use the `update-trail` command to disable multi-region logging, so their attacks do not get logged to the other regions.
Ex: `aws cloudtrail update-trail --name [my-trail] --no-is-multi-region-trail --no-include-global-service-events`
The attacker may also modify the settings so that the logs get encrypted with a key the attacker only has to prevent reading of the logs.
The attacker may also redirect the logs to a S3 bucket they control.
references:
- https://medium.com/daniel-grzelak/disrupting-aws-logging-a42e437d6594
- https://logrhythm.com/blog/aws-defense-evasion-and-centralized-multi-account-logging/
- https://traildiscover.cloud/#CloudTrail-UpdateTrail
author: Zach Mathis (@yamatosecurity)
date: 2025-04-23
modified: 2025-04-23
tags:
- attack.defense-evasion
- attack.t1562.008 # Impair Defenses: Disable or Modify Cloud Logs
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: 'cloudtrail.amazonaws.com'
eventName: 'UpdateTrail'
filter:
errorCode: 'AccessDenied'
condition: selection and not filter
falsepositives:
- Admins modified log settings.
level: high
Stages and Predicates
Stage 0: condition
selection and not filterStage 1: selection
selection:
eventSource: 'cloudtrail.amazonaws.com'
eventName: 'UpdateTrail'
Stage 2: not filter
filter:
errorCode: 'AccessDenied'
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
errorCode | eq | AccessDenied |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
eventName | eq |
|
eventSource | eq |
|