AWS CloudTrail Log Created

  1[metadata]
  2creation_date = "2020/06/10"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2025/11/07"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects creation of a new AWS CloudTrail trail via CreateTrail API. While legitimate during onboarding or auditing
 11improvements, adversaries can create trails that write to attacker-controlled destinations, limit regions, or otherwise
 12subvert monitoring objectives. New trails should be validated for destination ownership, encryption, multi-region
 13coverage, and organizational scope.
 14"""
 15false_positives = [
 16    """
 17    Trail creations may be made by a system or network administrator. Verify whether the user identity, user agent,
 18    and/or hostname should be making changes in your environment. Trail creations by unfamiliar users or hosts should be
 19    investigated. If known behavior is causing false positives, it can be exempted from the rule.
 20    """,
 21]
 22from = "now-6m"
 23index = ["filebeat-*", "logs-aws.cloudtrail-*"]
 24language = "kuery"
 25license = "Elastic License v2"
 26name = "AWS CloudTrail Log Created"
 27note = """## Triage and analysis
 28
 29> **Disclaimer**:
 30> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 31
 32### Investigating AWS CloudTrail Log Created
 33
 34AWS CloudTrail is a service that enables governance, compliance, and operational and risk auditing of your AWS account. It logs API calls and related events, providing visibility into user activity. Adversaries may create new trails to capture sensitive data or cover their tracks. This detection identifies
 35`CreateTrail` calls so responders can verify destination ownership, encryption, and scope before accepting the change.
 36
 37#### Possible investigation steps
 38
 39- **Identify the actor and context**
 40  - Review `aws.cloudtrail.user_identity.arn`, `aws.cloudtrail.user_identity.type`, `user_agent.original`, `source.ip`.
 41  - Confirm a related change request exists (onboarding, architecture change).
 42- **Validate trail configuration**
 43  - In `aws.cloudtrail.request_parameters`, verify:
 44    - `S3BucketName`/`CloudWatchLogsLogGroupArn` belong to your org (no external accounts).
 45    - `IsMultiRegionTrail=true` and `IncludeGlobalServiceEvents=true` (as per your standard).
 46    - `KmsKeyId` is an approved CMK; log file validation enabled.
 47- **Correlate activity**
 48  - Look for `PutEventSelectors`, `PutInsightSelectors`, `StartLogging` following creation.
 49  - Check for prior enumeration: `DescribeTrails`, `ListBuckets`, `GetEventSelectors`.
 50
 51### False positive analysis
 52- **Planned creation**: Onboarding or compliance initiatives often add trails. Validate via ticket and standard template.
 53- **Automation**: IaC or control-tower pipelines may create trails on account bootstrap.
 54
 55### Response and remediation
 56- **If unauthorized**
 57  - Disable or delete the trail; verify and secure the destination S3/CloudWatch resources.
 58  - Review the actor’s recent changes and rotate credentials if compromise is suspected.
 59- **Hardening**
 60  - Restrict `cloudtrail:CreateTrail` to admin roles.
 61  - Use AWS Config / Security Hub controls to enforce multi-region, global events, and validated destinations.
 62
 63### Additional information
 64- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)** 
 65- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)** 
 66- **Security Best Practices:** [AWS Knowledge Center – Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/).
 67"""
 68references = [
 69    "https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_CreateTrail.html",
 70    "https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cloudtrail/create-trail.html",
 71]
 72risk_score = 21
 73rule_id = "594e0cbf-86cc-45aa-9ff7-ff27db27d3ed"
 74severity = "low"
 75tags = [
 76    "Domain: Cloud",
 77    "Data Source: AWS",
 78    "Data Source: Amazon Web Services",
 79    "Data Source: AWS Cloudtrail",
 80    "Use Case: Log Auditing",
 81    "Tactic: Collection",
 82    "Resources: Investigation Guide",
 83]
 84timestamp_override = "event.ingested"
 85type = "query"
 86
 87query = '''
 88event.dataset: "aws.cloudtrail" 
 89    and event.provider: "cloudtrail.amazonaws.com" 
 90    and event.action: "CreateTrail" 
 91    and event.outcome: "success"
 92'''
 93
 94
 95[[rule.threat]]
 96framework = "MITRE ATT&CK"
 97[[rule.threat.technique]]
 98id = "T1530"
 99name = "Data from Cloud Storage"
100reference = "https://attack.mitre.org/techniques/T1530/"
101
102
103[rule.threat.tactic]
104id = "TA0009"
105name = "Collection"
106reference = "https://attack.mitre.org/tactics/TA0009/"
107
108[rule.investigation_fields]
109field_names = [
110    "@timestamp",
111    "user.name",
112    "user_agent.original",
113    "source.ip",
114    "aws.cloudtrail.user_identity.arn",
115    "aws.cloudtrail.user_identity.type",
116    "aws.cloudtrail.user_identity.access_key_id",
117    "event.action",
118    "event.outcome",
119    "cloud.account.id",
120    "cloud.region",
121    "aws.cloudtrail.request_parameters",
122    "aws.cloudtrail.response_elements",
123]