Techniques
Sample rules
AWS CloudTrail Log Deleted
- source: elastic
- technicques:
- T1562
Description
Identifies the deletion of an AWS log trail. An adversary may delete trails in an attempt to evade defenses.
Detection logic
event.dataset:aws.cloudtrail and event.provider:cloudtrail.amazonaws.com and event.action:DeleteTrail and event.outcome:success