Use Case: Cloud
CloudTrail tampering detection
An IAM user called StopLogging on your primary CloudTrail trail at 11:59 PM. The trail covers us-east-1. ManySignal had a P1 alert open before midnight. The gap was 4 minutes.
The first thing attackers do after escalating in AWS
In AWS environments, CloudTrail is the primary audit trail. An attacker who has obtained IAM credentials with sufficient privileges will often attempt to disable or modify CloudTrail as their first post-escalation action — the equivalent of erasing security camera footage before committing a crime. Without CloudTrail, subsequent API calls in the affected region leave no trace in the standard audit infrastructure.
The critical insight is that the StopLogging and DeleteTrail API calls themselves are logged before the trail goes silent. If ManySignal is monitoring in real time, the tampering event generates an alert before the attacker's subsequent activity becomes invisible. Additionally, AWS Config and VPC Flow Logs continue independently.
rule: cloudtrail_defense_evasion
type: cloud_audit + integrity
sources:
- aws_cloudtrail (real-time via EventBridge)
- aws_config_stream
- cloudwatch_logs
trigger:
- event: [StopLogging, DeleteTrail, UpdateTrail, PutEventSelectors]
- condition: |
actor NOT IN [known_iac_roles, break_glass_accounts]
OR UpdateTrail.IncludeGlobalServiceEvents == false
OR UpdateTrail.IsMultiRegionTrail == false
enrichments:
- actor_context: iam_principal_history, last_access
- gap_reconstruction: aws_config_timeline, vpc_flow_logs
- parallel_activity: cloudwatch_logs_15m_window
- iac_correlation: terraform_run, maintenance_window
mitre: T1562.008 (Impair Defenses: Disable Cloud Logs)Which CloudTrail trail was stopped or modified, and which regions does it cover?
CloudTrail APIWhat IAM principal made the change — is it a known admin or an unexpected account?
CloudTrail eventWas log file validation disabled, and if so, are existing log files still intact?
S3 log integrity checkWhat API calls occurred in the 15 minutes after the trail was stopped?
CloudWatch LogsIs there a parallel logging path (AWS Config, VPC Flow Logs) that was not affected?
AWS ConfigWas this change part of a known maintenance window or IaC apply?
Change managementImmediately re-enable the disabled CloudTrail trail via AWS API
AutonomousAlert the CISO and AWS account owner — trail tampering is a P1 event by default
AutonomousReconstruct the activity gap using AWS Config timeline and VPC Flow Logs
AutonomousInvestigate the IAM principal that made the change for signs of compromise
Approve-gatedApply an SCP to prevent StopLogging and DeleteTrail across the AWS organization
RecommendMITRE ATT&CK mapping
CloudTrail tampering FAQ
Can an attacker completely evade detection by disabling CloudTrail?
Disabling CloudTrail itself is logged — including the StopLogging event. ManySignal receives this event before the trail goes silent. Additionally, AWS Config records continue independently of CloudTrail, and VPC Flow Logs operate at the network layer. An attacker cannot erase all logging simultaneously without triggering multiple distinct alerts.
What's the detection latency for CloudTrail tampering?
CloudTrail events appear in ManySignal's pipeline within 5-15 minutes of occurrence (standard CloudTrail delivery latency). CloudTrail Insights and EventBridge rules can reduce this to under 60 seconds for the most critical API calls including StopLogging and DeleteTrail.
Does ManySignal monitor AWS Config and GuardDuty in addition to CloudTrail?
Yes. ManySignal ingests AWS Config configuration change events, GuardDuty findings, Security Hub consolidated findings, and VPC Flow Logs. These sources provide coverage during any CloudTrail gap and add posture context that CloudTrail alone doesn't capture.
Is CloudTrail tampering commonly seen in real incidents?
Yes. The CISA advisory AA23-061A and multiple public incident reports document CloudTrail disablement as a post-compromise defense evasion step. After gaining initial access and escalating privileges, attackers routinely disable logging before proceeding with data exfiltration or lateral movement.
Catch CloudTrail tampering before the attacker's next move
Real-time EventBridge monitoring with parallel log source reconstruction. Zero gap in visibility.