Disable or Modify Tools: Disable or Modify Cloud Log `T1685.002`

Tactic: Defense Impairment

An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an adversary has sufficient permissions, they can disable or modify logging to avoid detection of their activities.

Authoring guide

These 91 rules share fields, values, and exclusions.

Fields filtered most (79 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`aws::eventName`	30	`eq` 28, `in` 4	`deletetrail`, `stoplogging`, `updatetrail`, `deletedetector`, `deleteeventbus`
`data_stream.dataset`	25	`eq` 25	`aws.cloudtrail`, `azure.activitylogs`, `gcp.audit`
`event.outcome`	25	`eq` 25	`success`
`EventType`	23	`eq` 17, `in` 3, `wildcard` 3	`DELETE`, `PutBucketLifecycle`, `PutBucketLogging`, `UPDATE`, `createtrail`
`sourcetype`	19	`eq` 19	`aws:cloudtrail`, `aws:asl`, `httpevent`, `o365:management:activity`
`Provider_Name`	17	`eq` 17	`cloudtrail.amazonaws.com`, `config.amazonaws.com`, `logs.amazonaws.com`, `s3.amazonaws.com`, `bedrock.amazonaws.com`
`aws::eventSource`	17	`eq` 17, `in` 1	`cloudtrail.amazonaws.com`, `bedrock.amazonaws.com`, `guardduty.amazonaws.com`, `config.amazonaws.com`, `logs.amazonaws.com`
`aws::errorCode`	14	`eq` 12, `is_null` 3	`accessdenied`, `success`
`EventID`	11	`eq` 11	`Set-AdminAuditLogConfig`, `SetIamPolicy`, `DeleteAnalyzer`, `DeleteConfigurationRecorder`, `DeleteDeliveryChannel`
`security_result.action`	7	`eq` 7	`ALLOW`
`action`	5	`eq` 5	`audit_log_streaming.update`, `ADD`, `audit_log_streaming.destroy`, `ekm_logging_config_set`
`operationName`	5	`eq` 4, `in` 1	`MICROSOFT.INSIGHTS/ALERTRULES/DELETE`, `MICROSOFT.INSIGHTS/METRICALERTS/DELETE`, `microsoft.eventhub/namespaces/eventhubs/delete`, `microsoft.insights/actiongroups/delete`, `microsoft.insights/diagnosticsettings/delete`
`resultType`	5	`in` 5	`Succeeded`, `Success`
`azure.activitylogs.operation_name`	4	`eq` 4	`microsoft.eventhub/namespaces/eventhubs/delete`, `microsoft.insights/diagnosticsettings/delete`, `microsoft.kubernetes/connectedclusters/events.k8s.io/even...`, `microsoft.network/networkwatchers/delete`
`userAgent`	4	`ne` 4	`console.amazonaws.com`

Top indicator values (211 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.outcome`	`eq`	`success` elasticAWS Bedrock Model Invocation Logging Disabled or Modified elasticAWS CloudTrail Log Created elasticAWS CloudTrail Log Deleted elasticAWS CloudTrail Log Evasion elasticAWS CloudTrail Log Suspended elasticAWS CloudTrail Log Updated elasticAWS CloudTrail Management Events Disabled via PutEventSelectors elasticAWS CloudWatch Log Group Deletion elasticAWS CloudWatch Log Stream Deletion elasticAWS Config Resource Deletion elasticAWS Configuration Recorder Stopped elasticAWS EKS Control Plane Logging Disabled elasticAWS Route 53 Resolver Query Log Configuration Deleted elasticAWS S3 Bucket Configuration Deletion elasticAWS S3 Bucket Expiration Lifecycle Configuration Added +10 more rules	25	375
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS Bedrock Model Invocation Logging Disabled or Modified elasticAWS CloudTrail Log Created elasticAWS CloudTrail Log Deleted elasticAWS CloudTrail Log Evasion elasticAWS CloudTrail Log Suspended elasticAWS CloudTrail Log Updated elasticAWS CloudTrail Management Events Disabled via PutEventSelectors elasticAWS CloudWatch Log Group Deletion elasticAWS CloudWatch Log Stream Deletion elasticAWS Config Resource Deletion elasticAWS Configuration Recorder Stopped elasticAWS EKS Control Plane Logging Disabled elasticAWS Route 53 Resolver Query Log Configuration Deleted elasticAWS S3 Bucket Configuration Deletion elasticAWS S3 Bucket Expiration Lifecycle Configuration Added +3 more rules	18	173
`data_stream.dataset`	`eq`	`azure.activitylogs` elasticAzure Diagnostic Settings Deleted elasticAzure Event Hub Deleted elasticAzure Kubernetes Services (AKS) Kubernetes Events Deleted elasticAzure VNet Network Watcher Deleted	4	39
`data_stream.dataset`	`eq`	`gcp.audit` elasticGCP Logging Bucket Deletion elasticGCP Logging Sink Deletion elasticGCP Logging Sink Modification	3	69
`aws::eventSource`	`eq`	`cloudtrail.amazonaws.com` sigmaAttempt To Delete A CloudTrail Log sigmaAttempt To Modify CloudTrail Log Settings sigmaAttempt To Stop CloudTrail Logging sigmaAWS CloudTrail Important Change sigmaCloudTrail Log Deleted sigmaCloudTrail Log Settings Modified sigmaCloudTrail Logging Stopped splunkAWS Defense Evasion Delete Cloudtrail splunkAWS Defense Evasion Stop Logging Cloudtrail splunkAWS Defense Evasion Update Cloudtrail	10	10
`sourcetype`	`eq`	`aws:cloudtrail` splunkAWS Bedrock Delete GuardRails splunkAWS Bedrock Delete Model Invocation Logging Configuration splunkAWS Defense Evasion Delete Cloudtrail splunkAWS Defense Evasion Delete CloudWatch Log Group splunkAWS Defense Evasion Impair Security Services splunkAWS Defense Evasion PutBucketLifecycle splunkAWS Defense Evasion Stop Logging Cloudtrail splunkAWS Defense Evasion Update Cloudtrail	8	59
`sourcetype`	`eq`	`aws:asl` splunkASL AWS Defense Evasion Delete Cloudtrail splunkASL AWS Defense Evasion Delete CloudWatch Log Group splunkASL AWS Defense Evasion Impair Security Services splunkASL AWS Defense Evasion PutBucketLifecycle splunkASL AWS Defense Evasion Stop Logging Cloudtrail splunkASL AWS Defense Evasion Update Cloudtrail	6	27
`sourcetype`	`eq`	`httpevent` splunkGitHub Enterprise Disable Audit Log Event Stream splunkGitHub Enterprise Modify Audit Log Event Stream splunkGitHub Enterprise Pause Audit Log Event Stream	3	12
`security_result.action`	`eq`	`ALLOW` chronicleAWS CloudTrail Logging Tampered chronicleAWS Config Service Modified chronicleAWS Delete CloudWatch Log Group chronicleAWS Delete VPC Flow Logs chronicleAWS IAM Access Analyzer Deleted chronicleGCP Cloud Audit Logging Removed From All Services chronicleGCP Exempt Principals From Audit Log	7	102
`aws::errorCode`	`eq`	`accessdenied` sigmaAttempt To Delete A CloudTrail Log sigmaAttempt To Modify CloudTrail Log Settings sigmaAttempt To Stop CloudTrail Logging sigmaCloudTrail Log Deleted sigmaCloudTrail Log Settings Modified sigmaCloudTrail Logging Stopped	6	16
`aws::errorCode`	`eq`	`success` sigmaAWS GuardDuty Detector Deleted Or Updated splunkAWS Defense Evasion Delete Cloudtrail splunkAWS Defense Evasion Delete CloudWatch Log Group splunkAWS Defense Evasion PutBucketLifecycle splunkAWS Defense Evasion Stop Logging Cloudtrail splunkAWS Defense Evasion Update Cloudtrail	6	16
`Provider_Name`	`eq`	`cloudtrail.amazonaws.com` elasticAWS CloudTrail Log Created elasticAWS CloudTrail Log Deleted elasticAWS CloudTrail Log Suspended elasticAWS CloudTrail Log Updated elasticAWS CloudTrail Management Events Disabled via PutEventSelectors	5	5
`Provider_Name`	`eq`	`config.amazonaws.com` elasticAWS Config Resource Deletion elasticAWS Configuration Recorder Stopped	2	2
`Provider_Name`	`eq`	`logs.amazonaws.com` elasticAWS CloudWatch Log Group Deletion elasticAWS CloudWatch Log Stream Deletion	2	2
`Provider_Name`	`eq`	`s3.amazonaws.com` elasticAWS S3 Bucket Configuration Deletion elasticAWS S3 Bucket Server Access Logging Disabled	2	15
`aws::eventName`	`eq`	`deletetrail` sigmaAttempt To Delete A CloudTrail Log sigmaAWS CloudTrail Important Change sigmaCloudTrail Log Deleted splunkASL AWS Defense Evasion Delete Cloudtrail splunkAWS Defense Evasion Delete Cloudtrail	5	5
`aws::eventName`	`eq`	`stoplogging` sigmaAttempt To Stop CloudTrail Logging sigmaAWS CloudTrail Important Change sigmaCloudTrail Logging Stopped splunkASL AWS Defense Evasion Stop Logging Cloudtrail splunkAWS Defense Evasion Stop Logging Cloudtrail	5	5
`aws::eventName`	`eq`	`updatetrail` sigmaAttempt To Modify CloudTrail Log Settings sigmaAWS CloudTrail Important Change sigmaCloudTrail Log Settings Modified splunkASL AWS Defense Evasion Update Cloudtrail splunkAWS Defense Evasion Update Cloudtrail	5	5
`aws::eventName`	`eq`	`deletedetector` sigmaAWS GuardDuty Detector Deleted Or Updated splunkAWS Defense Evasion Impair Security Services	2	2
`aws::eventName`	`eq`	`deleteloggroup` splunkASL AWS Defense Evasion Delete CloudWatch Log Group splunkAWS Defense Evasion Delete CloudWatch Log Group	2	2
`resultType`	`in`	`Succeeded` pantherAzure Action Groups Deleted pantherAzure Alert Rules Deleted pantherAzure Diagnostic Settings Deleted pantherAzure Event Hub Deleted pantherAzure Log Analytics Workspace Deleted	5	51
`resultType`	`in`	`Success` pantherAzure Action Groups Deleted pantherAzure Alert Rules Deleted pantherAzure Diagnostic Settings Deleted pantherAzure Event Hub Deleted pantherAzure Log Analytics Workspace Deleted	5	51
`userAgent`	`ne`	`console.amazonaws.com` splunkAWS Defense Evasion Delete Cloudtrail splunkAWS Defense Evasion Delete CloudWatch Log Group splunkAWS Defense Evasion Stop Logging Cloudtrail splunkAWS Defense Evasion Update Cloudtrail	4	6
`event.errorcode`	`eq`	`None` pantherZIA Backup Deleted pantherZIA Golden Restore Point Dropped pantherZIA Log Streaming Disabled	3	10
`event.result`	`eq`	`SUCCESS` pantherZIA Backup Deleted pantherZIA Golden Restore Point Dropped pantherZIA Log Streaming Disabled	3	10
`EventID`	`eq`	`Set-AdminAuditLogConfig` chronicleOffice 365 logging has been enabled chronicleOffice 365 logging is disabled	2	2
`EventID`	`eq`	`SetIamPolicy` chronicleGCP Cloud Audit Logging Removed From All Services chronicleGCP Exempt Principals From Audit Log	2	4
`EventType`	`eq`	`DELETE` pantherZIA Backup Deleted pantherZIA Log Streaming Disabled	2	3
`OperationName`	`eq`	`auditlog.streamdisabledbyuser` kustoAzure DevOps Audit Stream Disabled kustoNRT Azure DevOps Audit Stream Disabled	2	2
`action`	`eq`	`audit_log_streaming.update` splunkGitHub Enterprise Modify Audit Log Event Stream splunkGitHub Enterprise Pause Audit Log Event Stream	2	2

Exclusions (24 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`aws::userAgent`	`contains`	`pulumi` elasticAWS CloudTrail Log Updated elasticAWS CloudWatch Log Group Deletion elasticAWS CloudWatch Log Stream Deletion elasticAWS Config Resource Deletion elasticAWS S3 Bucket Configuration Deletion elasticAWS S3 Bucket Expiration Lifecycle Configuration Added elasticAWS S3 Bucket Server Access Logging Disabled elasticAWS VPC Flow Logs Deletion	8
`aws::userAgent`	`contains`	`terraform` elasticAWS CloudTrail Log Updated elasticAWS CloudWatch Log Group Deletion elasticAWS CloudWatch Log Stream Deletion elasticAWS Config Resource Deletion elasticAWS S3 Bucket Configuration Deletion elasticAWS S3 Bucket Expiration Lifecycle Configuration Added elasticAWS S3 Bucket Server Access Logging Disabled elasticAWS VPC Flow Logs Deletion	8
`aws::errorCode`	`eq`	`accessdenied` sigmaCloudTrail Log Deleted sigmaCloudTrail Log Settings Modified sigmaCloudTrail Logging Stopped	3
`aws::userAgent`	`eq`	`aws internal` elasticAWS CloudWatch Log Group Deletion elasticAWS CloudWatch Log Stream Deletion	2
`ActivityStatusValue`	`contains`	`succeeded` kustoAzure Diagnostic settings removed from a resource	1
`ActivityStatusValue`	`contains`	`success` kustoAzure Diagnostic settings removed from a resource	1
`Category`	`eq`	`audit.security-events` kustoSAP BTP - Unaudited custom app with login-only activity	1
`TimeGenerated`	`cross_field_compare`	`audit_lookback` kustoSAP BTP - Unaudited custom app with login-only activity	1
`XsAppName`	`contains`	`app-studio` kustoSAP BTP - Unaudited custom app with login-only activity	1
`XsAppName`	`contains`	`auditlog` kustoSAP BTP - Unaudited custom app with login-only activity	1
`XsAppName`	`contains`	`cis-local` kustoSAP BTP - Unaudited custom app with login-only activity	1
`XsAppName`	`contains`	`connectivity-proxy` kustoSAP BTP - Unaudited custom app with login-only activity	1
`XsAppName`	`contains`	`destination-xsappname` kustoSAP BTP - Unaudited custom app with login-only activity	1
`XsAppName`	`contains`	`feature-flags` kustoSAP BTP - Unaudited custom app with login-only activity	1
`XsAppName`	`contains`	`service-manager` kustoSAP BTP - Unaudited custom app with login-only activity	1

Disable or Modify Tools: Disable or Modify Cloud Log `T1685.002`

Authoring guide

Fields filtered most (79 distinct)

Top indicator values (211 distinct)

Exclusions (24 distinct)

Rules under this technique

Sigma 9 rules

Elastic 25 rules

Splunk 19 rules

Kusto 9 rules

YARA-L 11 rules

Panther 18 rules

Disable or Modify Tools: Disable or Modify Cloud Log T1685.002

Authoring guide

Fields filtered most (79 distinct)

Top indicator values (211 distinct)

Exclusions (24 distinct)

Rules under this technique

Sigma 9 rules

Elastic 25 rules

Splunk 19 rules

Kusto 9 rules

YARA-L 11 rules

Panther 18 rules

Disable or Modify Tools: Disable or Modify Cloud Log `T1685.002`