T1685.002 Disable or Modify Cloud Log
Sub-technique of T1685 Disable or Modify Tools
An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an adversary has sufficient permissions, they can disable or modify logging to…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- AWS Config Disabling Channel/Recorderhightest · aws
- AWS GuardDuty Detector Deleted Or Updatedhighexperimental · aws
- AWS CloudTrail Important Changemediumtest · aws
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.