CloudTrail Log Deleted

Status: test
Severity: medium
Log source: product aws, service cloudtrail
Author: Zach Mathis (@yamatosecurity)
Source: github.com/Yamato-Security/suzaku-rules

A user attempted to delete a CloudTrail log but it was denied due to a lack of permissions. Sample command line: aws cloudtrail delete-trail --name TrailName

Known false positives

Admin deleted unneeded logs.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685.002` Disable or Modify Tools: Disable or Modify Cloud Log

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `DeleteTrail`: Deletes a CloudTrail trail, permanently stopping the delivery of log files for that trail to its configured S3 bucket.

Rules detecting the same action

These rules filter on the same operation.

Attempt To Delete A CloudTrail Log (Sigma)
AWS CloudTrail Important Change (Sigma)
AWS CloudTrail Log Deleted (Elastic)
AWS Defense Evasion Delete Cloudtrail (Splunk)

Rule body

title: CloudTrail Log Deleted
id: fa5c25ee-9c78-4af4-916f-52a81d1d16e6
status: test
description: |
    A user attempted to delete a CloudTrail log but it was denied due to a lack of permissions.
    Sample command line: aws cloudtrail delete-trail --name TrailName
references:
    - https://research.splunk.com/cloud/82092925-9ca1-4e06-98b8-85a2d3889552/
    - https://expel.com/blog/following-cloudtrail-generating-aws-security-signals-sumo-logic/
    - https://medium.com/daniel-grzelak/disrupting-aws-logging-a42e437d6594
    - https://traildiscover.cloud/#CloudTrail-DeleteTrail
author: Zach Mathis (@yamatosecurity)
date: 2025-04-23
modified: 2025-04-23
tags:
    - attack.defense-evasion
    - attack.t1562.008 # Impair Defenses: Disable or Modify Cloud Logs
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'cloudtrail.amazonaws.com'
        eventName: 'DeleteTrail'
    filter:
        errorCode: 'AccessDenied'
    condition: selection and not filter
falsepositives:
    - Admin deleted unneeded logs.
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
    eventSource: 'cloudtrail.amazonaws.com'
    eventName: 'DeleteTrail'

Stage 2: `not filter`

filter:
    errorCode: 'AccessDenied'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`errorCode`	eq	`AccessDenied`	`excludes:errorCode` `field:"errorCode" value:"AccessDenied"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`DeleteTrail`	`field:"aws::eventName" kind:eq value:"DeleteTrail"`
`eventSource`	eq	`cloudtrail.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"cloudtrail.amazonaws.com"`