Use Case: Cloud
Audit logging disabled
Microsoft 365 Unified Audit Log was toggled off at 2:11 AM. The setting change took one API call. ManySignal had a P0 alert in the SOC before the attacker's next action became invisible.
Erasing the footage before the theft
Audit log tampering is the digital equivalent of disabling security cameras before a robbery. An attacker who has gained administrative access to a cloud environment or SaaS platform will often disable logging as a first step — creating a window of invisibility for subsequent data access, lateral movement, or persistence establishment. The disablement itself is logged in the moment before the trail goes dark, which is the detection opportunity.
Microsoft 365's Unified Audit Log is a particularly high-value target: a single API call can disable logging across the entire M365 tenant, leaving no trail for Exchange, SharePoint, Teams, or Azure AD activity.
rule: audit_log_disablement
type: config_change + P0
sources:
- aws_cloudtrail_eventbridge (real-time)
- microsoft_365_management_api
- gcp_admin_activity
- okta_system_log
trigger:
- event: [StopLogging, DeleteTrail, UAL_disabled,
DiagnosticSettings.deleted, AuditLog.setIamPolicy(disable)]
- severity: P0 (always, regardless of actor)
- condition: actor NOT IN [known_maintenance_scripts]
enrichments:
- actor_context: full_session_history
- gap_window: estimated_blind_spot_duration
- parallel_logs: aws_config, vpc_flow_logs, still_active
- independent_archive: manysignal_retained_copy
mitre: T1562.008 (Disable Cloud Logs), T1070 (Indicator Removal)MITRE ATT&CK mapping
Audit log tampering FAQ
What audit logging disablement events does ManySignal monitor?
AWS: CloudTrail StopLogging, DeleteTrail, PutEventSelectors (removing critical events). Azure: Diagnostic Settings deletion, Monitor Log Profile deletion, Entra ID Audit Log retention reduction. GCP: Cloud Audit Log disablement, Logging sink deletion. M365: Unified Audit Log disablement via Set-AdminAuditLogConfig or UAL toggle in Security & Compliance Center. Okta: System Log retention modification.
Can ManySignal detect partial log tampering — reducing coverage rather than full disablement?
Yes. Partial tampering is often more insidious because it's less obvious. ManySignal detects: event selector changes that exclude specific API call categories (e.g., removing data events from CloudTrail), retention period reductions that eliminate historical forensic capability, and log stream filtering that drops specific event types.
Does ManySignal maintain its own independent log archive?
Yes. ManySignal's data platform ingests and stores a copy of all security-relevant log events in its own storage, independent of the customer's logging infrastructure. If an attacker tampers with the customer's CloudTrail or SIEM, ManySignal's copy remains intact and provides forensic continuity for the investigation.
How quickly can an attacker benefit from disabling CloudTrail?
CloudTrail has a 5-15 minute delivery lag, so an attacker disabling it doesn't gain an immediate blind spot — they gain one 5-15 minutes after the disablement. ManySignal detects the StopLogging event within that same 5-15 minute window via EventBridge, before the effective blind spot begins.
Never lose visibility — audit log changes are always P0
Independent log archive with real-time disablement detection across all cloud platforms.