Sunturai
Back to results
MediumSplunk security contentBhavin Patel +1

AWS Defense Evasion Delete Cloudtrail

The following analytic detects the deletion of AWS CloudTrail logs by identifying `DeleteTrail` events within CloudTrail logs. This detection leverages CloudTrail data to monitor for successful `DeleteTrail` actions,…

Description

The following analytic detects the deletion of AWS CloudTrail logs by identifying `DeleteTrail` events within CloudTrail logs. This detection leverages CloudTrail data to monitor for successful `DeleteTrail` actions, excluding those initiated from the AWS console. This activity is significant because adversaries may delete CloudTrail logs to evade detection and operate stealthily within the compromised environment. If confirmed malicious, this action could allow attackers to cover their tracks, making it difficult to trace their activities and potentially leading to prolonged unauthorized access and further exploitation.

Detection logic

Detection requirements

Platform
IaaSIdentity ProviderOffice SuiteSaaS

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
aws_cloudtrail_deletetrail

Known benign triggers

  • While this search has no known false positives, it is possible that an AWS admin has stopped cloudTrail logging. Please investigate this activity.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice