Detect Disable or Modify Cloud Logs in Sumo Logic CSE
An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an adversary has sufficient permissions, they can disable or modify logging to avoid detection of their activities. For example, in AWS an adversary may disable CloudWatch/CloudTrail integrations prior to conducting further malicious activity. They may alternatively tamper with logging functionality by removing associated SNS topics, disabling multi-region logging, or disabling settings that validate and/or encrypt log files. In Office 365, an adversary may disable logging on mail collection activities for specific users by using the Set-MailboxAuditBypassAssociation cmdlet, by disabling M365 Advanced Auditing for the user, or by downgrading the user's license from an Enterprise E5 to an Enterprise E3 license.
MITRE ATT&CK
- Tactic
- Defense Impairment
- Technique
- T1685 Disable or Modify Tools
- Sub-technique
- T1685.002 Disable or Modify Cloud Log
- Canonical reference
- https://attack.mitre.org/techniques/T1685/002/
Sumo Detection Query
(_sourceCategory="aws/cloudtrail" OR _sourceCategory="azure/audit" OR _sourceCategory="o365/audit")
| json field=_raw "eventName" as cloud_action nodrop
| json field=_raw "operationName" as azure_action nodrop
| json field=_raw "Operation" as o365_action nodrop
| json field=_raw "userIdentity.arn" as aws_user nodrop
| json field=_raw "userIdentity.userName" as aws_user_name nodrop
| json field=_raw "sourceIPAddress" as src_ip nodrop
| json field=_raw "awsRegion" as aws_region nodrop
| json field=_raw "errorCode" as error_code nodrop
| json field=_raw "UserId" as o365_user nodrop
| json field=_raw "ClientIP" as o365_ip nodrop
| where cloud_action in ("StopLogging","DeleteTrail","UpdateTrail","PutEventSelectors","RemoveTargets","DeleteFlowLogs","DeleteDetector","DeleteMembers","DisableOrganizationAdminAccount")
OR azure_action in ("MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/DELETE","MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/WRITE","MICROSOFT.SECURITY/SECURITYCONTACTS/DELETE")
OR o365_action in ("Set-MailboxAuditBypassAssociation","Set-AdminAuditLogConfig","Disable-OrganizationCustomization","Set-OrganizationConfig")
| eval action = coalesce(cloud_action, azure_action, o365_action)
| eval actor = coalesce(aws_user, aws_user_name, o365_user, "unknown")
| eval source_ip = coalesce(src_ip, o365_ip, "unknown")
| eval severity_score = if(action in ("StopLogging","DeleteTrail","DeleteDetector"), 3, if(action in ("UpdateTrail","DeleteFlowLogs","MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/DELETE"), 2, 1))
| table _messageTime, action, actor, source_ip, aws_region, error_code, severity_score
| sort by severity_score desc, _messageTime descSumo Logic CSE query detecting cloud audit log tampering across AWS CloudTrail, Azure Diagnostics, and Microsoft 365. Scores each event by severity with destructive actions (StopLogging, DeleteTrail, DeleteDetector) ranked highest (T1562.008).
Data Sources
Required Tables
False Positives & Tuning
- DevOps teams running Terraform destroy/apply cycles that delete and recreate CloudTrail trails or Azure diagnostic settings as part of IaC workflows
- Cloud security posture management (CSPM) tools such as Prisma Cloud or Orca that enumerate and modify diagnostic settings for compliance assessment
- Microsoft 365 license management operations by IT admins that incidentally trigger audit log policy changes when adjusting user SKUs
Other platforms for T1685.002
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 AWS CloudTrail StopLogging Simulation
Expected signal: CloudTrail event: eventName=StopLogging, eventSource=cloudtrail.amazonaws.com. The event record includes requestParameters.name (trail name) and userIdentity (acting principal). If forwarded to Sentinel, appears in AWSCloudTrail table.
- Test 2 AWS GuardDuty DeleteDetector Simulation
Expected signal: CloudTrail event: eventName=DeleteDetector, eventSource=guardduty.amazonaws.com. The requestParameters include the detectorId. This event will appear in AWSCloudTrail table in Sentinel.
- Test 3 M365 Mailbox Audit Bypass via PowerShell
Expected signal: M365 Unified Audit Log: Operation=Set-MailboxAuditBypassAssociation, with Parameters showing the target mailbox and AuditBypassEnabled=True. Appears in OfficeActivity table in Sentinel.
References (8)
- https://attack.mitre.org/techniques/T1685/002/
- https://expel.io/blog/following-cloudtrail-generating-aws-security-signals-sumo-logic/
- https://docs.aws.amazon.com/awscloudtrail/latest/userguide/stop-cloudtrail-from-sending-events-to-cloudwatch-logs.html
- https://github.com/RhinoSecurityLabs/pacu/blob/master/pacu/modules/detection__disruption/main.py
- https://www.darkreading.com/threat-intelligence/incident-responders-explore-microsoft-365-attacks-in-the-wild/d/d-id/1341591
- https://www.mandiant.com/resources/blog/apt29-microsoft-365-2022
- https://docs.microsoft.com/en-us/cli/azure/monitor/diagnostic-settings
- https://cloud.google.com/logging/docs/audit/configure-data-access
Response Playbook
Triage
- Identify the IAM principal (user/role/service) that made the API call — is this a known admin, automation role, or an unexpected identity? Check the userIdentity.arn and sourceIPAddress fields.
- Determine the scope of the change — was a single trail modified or were multiple trails/regions affected? Multi-region or organization-wide changes are higher severity.
- Check if the change was preceded by privilege escalation — look for recent AssumeRole, CreateAccessKey, or ConsoleLogin events from the same identity in the last 24 hours.
- Verify against change management records — was there an approved change ticket or IaC pipeline run that corresponds to this API call?
- Check if logging was restored after the change — a legitimate reconfiguration typically creates a new trail shortly after deleting the old one.
- For M365 mailbox audit bypass: identify which mailbox was targeted and whether it belongs to a high-value user (executive, finance, legal).
Containment
- Immediately re-enable the disabled logging service (aws cloudtrail start-logging, recreate diagnostic settings, or remove mailbox audit bypass) to restore visibility.
- If the acting identity is compromised: revoke active sessions by attaching an inline deny-all policy, delete access keys, and reset console password.
- If the source IP is unknown or external: block the IP at the network perimeter (WAF, security group, NSG) and check for other API calls from the same IP.
- Enable an SCP (Service Control Policy) or Azure Policy to prevent future CloudTrail/diagnostic settings deletion across the organization.
- For M365: re-enable Advanced Auditing on affected mailboxes and check for mailbox rules or delegations added during the audit gap.
Evidence Collection
- AWS CloudTrail event history — export the full event record for the tampering API call including requestParameters and responseElements.
- AWS Config — check configuration timeline for the CloudTrail resource to see before/after state of the trail configuration.
- IAM Access Analyzer — review recent activity for the acting role/user to identify what other actions were taken during and after the logging gap.
- Azure Activity Log — for Azure diagnostic settings changes, export the full activity log entry with caller identity and resource details.
- M365 Unified Audit Log — search for the Set-MailboxAuditBypassAssociation operation and correlate with any subsequent mailbox access events.
- VPC Flow Logs (if still available from other sources) — check for unusual network patterns during the period logging was disabled.
Escalation Criteria
- !CloudTrail StopLogging or DeleteTrail on the organization's primary trail — this eliminates visibility across the entire account or organization.
- !Multiple logging services disabled in sequence (e.g., CloudTrail stopped, then GuardDuty detector deleted, then VPC Flow Logs removed) — indicates deliberate evidence destruction.
- !The acting identity was recently created or had its permissions escalated — suggests a compromised or attacker-created account.
- !Mailbox audit bypass set on executive or finance mailboxes — high likelihood of targeted email theft (APT29 TTP).
- !Source IP geolocates to a region where the organization has no employees or infrastructure.
- !No corresponding change ticket, IaC pipeline run, or administrator confirmation for the modification.
Investigation Guide
Forensic Artifacts
- >
AWS CloudTrail Event History — even if trails are deleted, the last 90 days of management events are available via the CloudTrail Event History console (read-only, cannot be deleted by users). - >
AWS Config — configuration snapshots and timeline show the state of CloudTrail resources before and after modification. - >
AWS S3 Access Logs — if the CloudTrail S3 bucket has server access logging enabled, these logs persist independently of CloudTrail configuration. - >
Azure Activity Log — retained for 90 days in Azure Monitor regardless of diagnostic settings changes (platform-level, not deletable by users). - >
M365 Unified Audit Log — search for Set-MailboxAuditBypassAssociation and correlate with MailItemsAccessed events. - >
AWS IAM Credential Report — shows when access keys were last used and from which IP, useful for identifying the compromised credential.
Tuning Guidance
Start by building an allowlist of IAM roles and service principals authorized to modify logging configurations — these are typically limited to cloud platform teams and IaC automation roles (e.g., Terraform, CloudFormation service roles). For AWS, consider implementing an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail for all principals except a break-glass role. For Azure, use Azure Policy to prevent deletion of diagnostic settings. For M365, restrict Set-MailboxAuditBypassAssociation to a small set of Exchange administrators and alert on any use. Exclude known IaC pipeline source IPs (CI/CD runners) but only by exact IP match, never by CIDR range. If your organization uses multiple AWS accounts, focus highest-severity alerts on the organization management account and security audit accounts where CloudTrail disruption has the greatest impact.
Hunting Queries
Hunt for IAM identities that have performed multiple cloud logging modification actions over a 30-day window. A single identity performing StopLogging followed by DeleteDetector across multiple regions is a strong indicator of deliberate evidence destruction by an adversary with compromised cloud credentials.
AWSCloudTrail
| where TimeGenerated > ago(30d)
| where EventName in ("StopLogging", "DeleteTrail", "UpdateTrail", "PutEventSelectors", "DeleteFlowLogs", "DeleteDetector")
| summarize EventCount=count(), Actions=make_set(EventName), Regions=make_set(AWSRegion) by UserIdentityArn, SourceIpAddress
| where EventCount > 1
| sort by EventCount descindex=aws sourcetype="aws:cloudtrail" (eventName="StopLogging" OR eventName="DeleteTrail" OR eventName="UpdateTrail" OR eventName="PutEventSelectors" OR eventName="DeleteFlowLogs" OR eventName="DeleteDetector")
| stats count as EventCount, values(eventName) as Actions, values(awsRegion) as Regions by userIdentity.arn, sourceIPAddress
| where EventCount > 1
| sort - EventCountHunt for the APT29 pattern: mailbox audit bypass followed by email access on the same mailbox. Correlates Set-MailboxAuditBypassAssociation events with subsequent MailItemsAccessed operations on the targeted mailbox, identifying cases where an adversary disabled auditing before stealing email.
OfficeActivity
| where TimeGenerated > ago(30d)
| where Operation == "Set-MailboxAuditBypassAssociation"
| extend TargetMailbox = tostring(parse_json(Parameters)[0].Value)
| project TimeGenerated, UserId, TargetMailbox, ClientIP, ResultStatus
| join kind=inner (
OfficeActivity
| where TimeGenerated > ago(30d)
| where Operation in ("MailItemsAccessed", "Send", "SendAs", "SendOnBehalf")
| project MailAccessTime=TimeGenerated, MailboxOwner=UserId, Operation
) on $left.TargetMailbox == $right.MailboxOwner
| where MailAccessTime > TimeGenerated
| sort by TimeGenerated ascindex=o365 sourcetype="o365:management:activity" Operation="Set-MailboxAuditBypassAssociation"
| spath output=TargetMailbox path="Parameters{}.Value"
| table _time, UserId, TargetMailbox, ClientIP, ResultStatus
| join type=inner TargetMailbox [
search index=o365 sourcetype="o365:management:activity" (Operation="MailItemsAccessed" OR Operation="Send" OR Operation="SendAs")
| rename UserId as TargetMailbox
| table _time, TargetMailbox, Operation
]
| sort _timeHunt for privilege escalation followed by logging disruption within the same 1-hour window. Correlates IAM escalation events (CreateUser, CreateAccessKey, AssumeRole, AttachUserPolicy) with CloudTrail StopLogging or DeleteTrail from the same identity, identifying adversaries who first gain privileges then blind defenders.
AWSCloudTrail
| where TimeGenerated > ago(7d)
| where EventName in ("StopLogging", "DeleteTrail")
| extend TimeBucket = bin(TimeGenerated, 1h)
| join kind=inner (
AWSCloudTrail
| where TimeGenerated > ago(7d)
| where EventName in ("CreateUser", "CreateAccessKey", "AssumeRole", "AttachUserPolicy", "PutUserPolicy")
| extend TimeBucket = bin(TimeGenerated, 1h)
) on UserIdentityArn, TimeBucket
| project TimeGenerated, EventName, EventName1, UserIdentityArn, SourceIpAddress, AWSRegionindex=aws sourcetype="aws:cloudtrail" (eventName="StopLogging" OR eventName="DeleteTrail")
| bucket _time span=1h
| join type=inner userIdentity.arn, _time [
search index=aws sourcetype="aws:cloudtrail" (eventName="CreateUser" OR eventName="CreateAccessKey" OR eventName="AssumeRole" OR eventName="AttachUserPolicy")
| bucket _time span=1h
]
| table _time, eventName, userIdentity.arn, sourceIPAddress, awsRegionAtomic Red Team Tests
Uses the AWS CLI to stop logging on a CloudTrail trail named 'test-trail'. This simulates the most common adversary action after gaining privileged AWS access — disabling CloudTrail to blind security monitoring. The trail must exist in the account beforehand. This is the technique used by Pacu's detection__disruption module.
Command
aws cloudtrail create-trail --name df00tech-test-trail --s3-bucket-name df00tech-test-bucket --no-is-multi-region-trail 2>/dev/null; aws cloudtrail stop-logging --name df00tech-test-trailCleanup
aws cloudtrail start-logging --name df00tech-test-trail; aws cloudtrail delete-trail --name df00tech-test-trailExpected Telemetry
CloudTrail event: eventName=StopLogging, eventSource=cloudtrail.amazonaws.com. The event record includes requestParameters.name (trail name) and userIdentity (acting principal). If forwarded to Sentinel, appears in AWSCloudTrail table.
Expected Detection
KQL: AWSCloudTrail query matches on EventName 'StopLogging'. SPL: Matched by eventName filter with SeverityScore=3 (highest).
Uses the AWS CLI to delete a GuardDuty detector, disabling threat detection for the account/region. Adversaries commonly disable GuardDuty after gaining admin access to prevent detection of subsequent malicious API calls, crypto-mining, and network scanning.
Command
DETECTOR_ID=$(aws guardduty list-detectors --query 'DetectorIds[0]' --output text 2>/dev/null); if [ "$DETECTOR_ID" != "None" ] && [ -n "$DETECTOR_ID" ]; then aws guardduty delete-detector --detector-id $DETECTOR_ID; fiCleanup
aws guardduty create-detector --enableExpected Telemetry
CloudTrail event: eventName=DeleteDetector, eventSource=guardduty.amazonaws.com. The requestParameters include the detectorId. This event will appear in AWSCloudTrail table in Sentinel.
Expected Detection
KQL: AWSCloudTrail query matches on EventName 'DeleteDetector'. SPL: Matched by eventName filter with SeverityScore=3.
Uses Exchange Online PowerShell to enable audit bypass on a test mailbox, replicating the APT29 technique of disabling mailbox auditing before stealing email. This command requires Exchange Admin permissions and a connected Exchange Online PowerShell session.
Command
powershell.exe -Command "Import-Module ExchangeOnlineManagement; Connect-ExchangeOnline -ShowBanner:$false; Set-MailboxAuditBypassAssociation -Identity '[email protected]' -AuditBypassEnabled $true"Cleanup
powershell.exe -Command "Set-MailboxAuditBypassAssociation -Identity '[email protected]' -AuditBypassEnabled $false; Disconnect-ExchangeOnline -Confirm:$false"Expected Telemetry
M365 Unified Audit Log: Operation=Set-MailboxAuditBypassAssociation, with Parameters showing the target mailbox and AuditBypassEnabled=True. Appears in OfficeActivity table in Sentinel.
Expected Detection
KQL: OfficeActivity query matches on Operation 'Set-MailboxAuditBypassAssociation'. SPL: Matched in o365:management:activity sourcetype.