TA0005 · DEFENSE EVASION
Disable or Modify Cloud Logs
T1562.008Sub-technique of Impair DefensesIaaS · SaaS · Office Suite · Identity Providerattack.mitre.org
An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection.
Detect it with
Monitor logs for API calls to disable logging. In AWS, monitor for: StopLogging and DeleteTrail .
Why it matters on shift
Disable or Modify Cloud Logs is one of the concrete ways adversaries achieve defense evasion. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After defense evasion, the next tactic is usually Credential Access. Search your telemetry for the transition before closing the ticket.
Kill-chain context