aws_cloudtrail_disable_logging.yml

title: AWS CloudTrail Important Change
id: 4db60cc0-36fb-42b7-9b58-a5b53019fb74
status: experimental
author: vitaliy0x1
date: 2020/01/21
description: Detects disabling, deleting and updating of a Trail
references:
    - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html
logsource:
    service: cloudtrail
detection:
    selection_source:
        - eventSource: cloudtrail.amazonaws.com
    events:
        - eventName:
            - StopLogging
            - UpdateTrail
            - DeleteTrail
    condition: selection_source AND events
level: medium
falsepositives:
    - Valid change in a Trail
tags:
    - attack.t1089
    - attack.t1562.001