CloudTrail Log Settings Modified

Status: test
Severity: high
Log source: product aws, service cloudtrail
Author: Zach Mathis (@yamatosecurity)
Source: github.com/Yamato-Security/suzaku-rules

An attacker may have attempted to modify CloudTrail log settings for anti-forensics but it was denied due to a lack of permissions. An attacker can use the update-trail command to disable multi-region logging, so their attacks do not get logged to the other regions. Ex: aws cloudtrail update-trail --name [my-trail] --no-is-multi-region-trail --no-include-global-service-events The attacker may also modify the settings so that the logs get encrypted with a key the attacker only has to prevent reading of the logs. The attacker may also redirect the logs to a S3 bucket they control.

Known false positives

Admins modified log settings.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685.002` Disable or Modify Tools: Disable or Modify Cloud Log

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `UpdateTrail`: Updates the settings of an existing CloudTrail trail, such as its S3 bucket, SNS topic, or log file validation configuration.

Rules detecting the same action

These rules filter on the same operation.

Attempt To Modify CloudTrail Log Settings (Sigma)
AWS CloudTrail Important Change (Sigma)
AWS CloudTrail Log Updated (Elastic)
AWS Defense Evasion Update Cloudtrail (Splunk)

Rule body

title: CloudTrail Log Settings Modified
id: 295b96b0-3345-4856-bd2f-2ca61ec89add
status: test
description: |
    An attacker may have attempted to modify CloudTrail log settings for anti-forensics but it was denied due to a lack of permissions.
    An attacker can use the `update-trail` command to disable multi-region logging, so their attacks do not get logged to the other regions.
    Ex: `aws cloudtrail update-trail --name [my-trail] --no-is-multi-region-trail --no-include-global-service-events`
    The attacker may also modify the settings so that the logs get encrypted with a key the attacker only has to prevent reading of the logs.
    The attacker may also redirect the logs to a S3 bucket they control.
references:
    - https://medium.com/daniel-grzelak/disrupting-aws-logging-a42e437d6594
    - https://logrhythm.com/blog/aws-defense-evasion-and-centralized-multi-account-logging/
    - https://traildiscover.cloud/#CloudTrail-UpdateTrail
author: Zach Mathis (@yamatosecurity)
date: 2025-04-23
modified: 2025-04-23
tags:
    - attack.defense-evasion
    - attack.t1562.008 # Impair Defenses: Disable or Modify Cloud Logs
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'cloudtrail.amazonaws.com'
        eventName: 'UpdateTrail'
    filter:
        errorCode: 'AccessDenied'
    condition: selection and not filter
falsepositives:
    - Admins modified log settings.
level: high

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
    eventSource: 'cloudtrail.amazonaws.com'
    eventName: 'UpdateTrail'

Stage 2: `not filter`

filter:
    errorCode: 'AccessDenied'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`errorCode`	eq	`AccessDenied`	`excludes:errorCode` `field:"errorCode" value:"AccessDenied"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`UpdateTrail`	`field:"aws::eventName" kind:eq value:"UpdateTrail"`
`eventSource`	eq	`cloudtrail.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"cloudtrail.amazonaws.com"`