LoFP / iac pipelines setting event selectors during trail creation always set includemanagementevents to true — the rule will not fire on those calls. the remaining fp vector is an administrator intentionally restricting a trail to data-events-only for cost reasons. validate the caller, change management ticket, and confirm this is not a multi-region or organization-wide trail where the coverage impact would be severe.

Techniques

• T1562

Sample rules

AWS CloudTrail Management Events Disabled via PutEventSelectors

• source: elastic
• technicques:
  • T1562

Description

Detects CloudTrail PutEventSelectors calls where the legacy event selectors explicitly set includeManagementEvents to false, disabling capture of all management API calls for that trail. Unlike StopLogging or DeleteTrail — which leave an obvious trace of the trail being stopped or removed entirely — this technique leaves the trail appearing active and healthy in the console while silently blinding defenders to subsequent IAM changes, credential operations, and resource abuse. This technique is documented in Stratus Red Team as aws.defense-evasion.cloudtrail-event-selectors and is a known pre-exfiltration step.

Detection logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "cloudtrail.amazonaws.com"
    and event.action: "PutEventSelectors"
    and event.outcome: "success"
    and aws.cloudtrail.request_parameters: *includeManagementEvents*false*