Sub-technique of T1685 Disable or Modify Tools.View on attack.mitre.org
An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an adversary has sufficient permissions, they can disable or modify logging to avoid detection of their activities.
For example, in AWS an adversary may disable CloudWatch/CloudTrail integrations prior to conducting further malicious activity. They may alternatively tamper with logging functionality, for example, by removing any associated SNS topics, disabling multi-region logging, or disabling settings that validate and/or encrypt log files. In Office 365, an adversary may disable logging on mail collection activities for specific users by using the Set-MailboxAuditBypassAssociation cmdlet, by disabling M365 Advanced Auditing for the user, or by downgrading the user’s license from an Enterprise E5 to an Enterprise E3 license.
Rules on DetectionCode tagged with T1685.002.
| Rule | Level | Log source |
|---|---|---|
| AWS Config Disabling Channel/Recorder | high | aws / NULL |
| AWS GuardDuty Detector Deleted Or Updated | high | aws / NULL |
| AWS CloudTrail Important Change | medium | aws / NULL |
| Rule | Type | Risk | Data source |
|---|---|---|---|
| ASL AWS Defense Evasion Delete Cloudtrail | TTP | NULL | ASL AWS CloudTrail |
| ASL AWS Defense Evasion Delete CloudWatch Log Group | TTP | NULL | ASL AWS CloudTrail |
| ASL AWS Defense Evasion Impair Security Services | Hunting | NULL | ASL AWS CloudTrail |
| ASL AWS Defense Evasion PutBucketLifecycle | Hunting | NULL | ASL AWS CloudTrail |
| ASL AWS Defense Evasion Stop Logging Cloudtrail | TTP | NULL | ASL AWS CloudTrail |
| ASL AWS Defense Evasion Update Cloudtrail | TTP | NULL | ASL AWS CloudTrail |
| AWS Bedrock Delete GuardRails | TTP | NULL | AWS CloudTrail DeleteGuardrail |
| AWS Bedrock Delete Model Invocation Logging Configuration | TTP | NULL | AWS CloudTrail DeleteModelInvocationLoggingConfiguration |
| AWS Defense Evasion Delete Cloudtrail | TTP | NULL | AWS CloudTrail DeleteTrail |
| AWS Defense Evasion Delete CloudWatch Log Group | TTP | NULL | AWS CloudTrail DeleteLogGroup |
| AWS Defense Evasion Impair Security Services | TTP | NULL | AWS CloudTrail DeleteLogStream, AWS CloudTrail DeleteDetector, AWS CloudTrail DeleteIPSet, AWS CloudTrail DeleteWebACL, AWS CloudTrail DeleteRule, AWS CloudTrail DeleteRuleGroup, AWS CloudTrail DeleteLoggingConfiguration, AWS CloudTrail DeleteAlarms |
| AWS Defense Evasion PutBucketLifecycle | Hunting | NULL | AWS CloudTrail PutBucketLifecycle |
| AWS Defense Evasion Stop Logging Cloudtrail | TTP | NULL | AWS CloudTrail StopLogging |
| AWS Defense Evasion Update Cloudtrail | TTP | NULL | AWS CloudTrail UpdateTrail |
| GitHub Enterprise Disable Audit Log Event Stream | Anomaly | NULL | GitHub Enterprise Audit Logs |
| GitHub Enterprise Modify Audit Log Event Stream | Anomaly | NULL | GitHub Enterprise Audit Logs |
| GitHub Enterprise Pause Audit Log Event Stream | Anomaly | NULL | GitHub Enterprise Audit Logs |
| O365 Advanced Audit Disabled | TTP | NULL | O365 Change user license. |
| O365 Email Security Feature Changed | TTP | NULL | Office 365 Universal Audit Log |
None recorded.
| Used by | Procedure example |
|---|---|
| GroupAPT29 | APT29 has disabled Purview Audit on targeted accounts prior to stealing emails from Microsoft 365 tenants. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
