Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

AWS CloudTrail Log Created

Detects creation of a new AWS CloudTrail trail via CreateTrail API. While legitimate during onboarding or auditing improvements, adversaries can create trails that write to attacker-controlled destinations, limit regions, or otherwise subvert monitoring objectives. New trails should be validated for destination ownership, encryption, multi-region coverage, and organizational scope.

ATT&CK coverage

Defense Impairment

T1685Disable or Modify ToolsMapped as T1562, withdrawn by ATT&CK.278 detections cover this technique
- T1685.002Disable or Modify Cloud LogMapped as T1562.008, withdrawn by ATT&CK.22 detections cover this technique

Collection

T1530Data from Cloud Storage 32 detections cover this technique

Detection requirements

Log source category: event_index

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.