AWS CloudTrail Log Deleted

  1[metadata]
  2creation_date = "2020/05/26"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2025/11/07"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects deletion of an AWS CloudTrail trail via DeleteTrail API. Removing trails is a high-risk action that destroys an
 11audit control plane and is frequently paired with other destructive or stealthy operations. Validate immediately and
 12restore compliant logging.
 13"""
 14false_positives = [
 15    """
 16    Trail deletions may be made by a system or network administrator. Verify whether the user identity, user agent,
 17    and/or hostname should be making changes in your environment. Trail deletions by unfamiliar users or hosts should be
 18    investigated. If known behavior is causing false positives, it can be exempted from the rule.
 19    """,
 20]
 21from = "now-6m"
 22index = ["filebeat-*", "logs-aws.cloudtrail-*"]
 23language = "kuery"
 24license = "Elastic License v2"
 25name = "AWS CloudTrail Log Deleted"
 26note = """## Triage and analysis
 27
 28> **Disclaimer**:
 29> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 30
 31### Investigating AWS CloudTrail Log Deleted
 32
 33AWS CloudTrail is a service that enables governance, compliance, and operational and risk auditing of your AWS account. It logs API calls and related events, providing visibility into user activity. This rule identifies the deletion of an AWS log trail using the `DeleteTrail` API. Deleting a trail can eliminate visibility and is a strong indicator of defense evasion or sabotage.
 34
 35#### Possible investigation steps
 36- **Actor & target**
 37  - Identify `aws.cloudtrail.user_identity.arn`, `user_agent.original`, `source.ip`.
 38  - Confirm which trail was deleted (name/ARN, multi-region/organization status) from `aws.cloudtrail.request_parameters` or `target.entity.id`.
 39- **Blast radius**
 40  - Determine whether it was the only trail or if organization/multi-region coverage remains.
 41  - Review preceding `StopLogging` or `UpdateTrail` and subsequent high-risk actions (IAM, S3, KMS, EC2 exports).
 42- **Data preservation**
 43  - Verify S3 destinations and CloudWatch log groups for retained historical logs and file integrity validation.
 44
 45### False positive analysis
 46- **Planned deletion**: Validate with tickets and decommissioning plans; ensure replacement/alternate trails exist.
 47
 48### Response and remediation
 49- Recreate or re-enable compliant multi-region (or organization) trails immediately.
 50- Investigate the actor’s recent activity; rotate creds if compromise is suspected.
 51- Validate destination bucket policies, CMK policies, and event selectors for all active trails.
 52- Hardening: Restrict `cloudtrail:DeleteTrail` and enforce guardrails via AWS Config/SCPs; alert on future deletions.
 53
 54### Additional information
 55- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)** 
 56- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)** 
 57- **Security Best Practices:** [AWS Knowledge Center – Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/).
 58"""
 59references = [
 60    "https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_DeleteTrail.html",
 61    "https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cloudtrail/delete-trail.html",
 62]
 63risk_score = 47
 64rule_id = "7024e2a0-315d-4334-bb1a-441c593e16ab"
 65severity = "medium"
 66tags = [
 67    "Domain: Cloud",
 68    "Data Source: AWS",
 69    "Data Source: Amazon Web Services",
 70    "Data Source: AWS Cloudtrail",
 71    "Use Case: Log Auditing",
 72    "Resources: Investigation Guide",
 73    "Tactic: Defense Evasion",
 74]
 75timestamp_override = "event.ingested"
 76type = "query"
 77
 78query = '''
 79event.dataset: "aws.cloudtrail"
 80    and event.provider: "cloudtrail.amazonaws.com"
 81    and event.action: "DeleteTrail"
 82    and event.outcome: "success"
 83'''
 84
 85
 86[[rule.threat]]
 87framework = "MITRE ATT&CK"
 88[[rule.threat.technique]]
 89id = "T1562"
 90name = "Impair Defenses"
 91reference = "https://attack.mitre.org/techniques/T1562/"
 92[[rule.threat.technique.subtechnique]]
 93id = "T1562.001"
 94name = "Disable or Modify Tools"
 95reference = "https://attack.mitre.org/techniques/T1562/001/"
 96
 97
 98
 99[rule.threat.tactic]
100id = "TA0005"
101name = "Defense Evasion"
102reference = "https://attack.mitre.org/tactics/TA0005/"
103
104[rule.investigation_fields]
105field_names = [
106    "@timestamp",
107    "user.name",
108    "user_agent.original",
109    "source.ip",
110    "aws.cloudtrail.user_identity.arn",
111    "aws.cloudtrail.user_identity.type",
112    "aws.cloudtrail.user_identity.access_key_id",
113    "target.entity.id",
114    "event.action",
115    "event.outcome",
116    "cloud.account.id",
117    "cloud.region",
118    "aws.cloudtrail.request_parameters",
119]