AWS CloudTrail Log Suspended

  1[metadata]
  2creation_date = "2020/06/10"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2025/11/07"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects Cloudtrail logging suspension via StopLogging API. Stopping CloudTrail eliminates forward audit visibility and
 11is a classic defense evasion step before sensitive changes or data theft. Investigate immediately and determine what
 12occurred during the logging gap.
 13"""
 14false_positives = [
 15    """
 16    Suspending the recording of a trail may be done by a system or network administrator. Verify whether the user
 17    identity, user agent, and/or hostname should be making changes in your environment. Trail suspensions from
 18    unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted
 19    from the rule.
 20    """,
 21]
 22from = "now-6m"
 23index = ["filebeat-*", "logs-aws.cloudtrail-*"]
 24language = "kuery"
 25license = "Elastic License v2"
 26name = "AWS CloudTrail Log Suspended"
 27note = """## Triage and analysis
 28
 29> **Disclaimer**:
 30> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 31
 32### Investigating AWS CloudTrail Log Suspended
 33
 34AWS CloudTrail is a service that enables governance, compliance, and operational and risk auditing of your AWS account. It logs API calls and related events, providing visibility into user activity. This rule identifies the suspension of an AWS log trail using the `StopLogging` API. Attackers can do this to cover their tracks and impact security monitoring that relies on this source.
 35
 36#### Possible investigation steps
 37- **Actor & scope**
 38  - Identify `aws.cloudtrail.user_identity.arn`, `user_agent.original`, `source.ip`.
 39  - Determine which trail stopped (`target.entity.id`) and whether it’s multi-region or organization-wide.
 40- **Timing and impact**
 41  - When did logging stop and resume (if at all)? Are there overlapping detections indicating activity during the gap?
 42- **Correlate activity**
 43  - Search for sensitive API activity around the stop event (IAM changes, S3 policy changes, EC2 exports, KMS changes).
 44  - Check for preceding `UpdateTrail` (e.g., destination change) and subsequent `DeleteTrail`.
 45
 46### False positive analysis
 47- **Planned suspensions**: Rare; verify maintenance tickets and ensure post-change validation.
 48
 49### Response and remediation
 50- Restart logging (`StartLogging`) immediately.
 51- Investigate actor’s recent activity; rotate credentials if suspicious.
 52- Validate trail configuration, destination bucket/CMK, and event selectors.
 53- Hardening: Limit `cloudtrail:StopLogging` to break-glass roles; alert on any future stops; enforce via AWS Config/SCPs.
 54
 55### Additional information
 56- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)** 
 57- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)** 
 58- **Security Best Practices:** [AWS Knowledge Center – Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/).
 59"""
 60references = [
 61    "https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_StopLogging.html",
 62    "https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cloudtrail/stop-logging.html",
 63]
 64risk_score = 47
 65rule_id = "1aa8fa52-44a7-4dae-b058-f3333b91c8d7"
 66severity = "medium"
 67tags = [
 68    "Domain: Cloud",
 69    "Data Source: AWS",
 70    "Data Source: Amazon Web Services",
 71    "Data Source: AWS Cloudtrail",
 72    "Use Case: Log Auditing",
 73    "Resources: Investigation Guide",
 74    "Tactic: Defense Evasion",
 75]
 76timestamp_override = "event.ingested"
 77type = "query"
 78
 79query = '''
 80event.dataset: "aws.cloudtrail" 
 81    and event.provider: "cloudtrail.amazonaws.com" 
 82    and event.action: "StopLogging" 
 83    and event.outcome: "success"
 84'''
 85
 86
 87[[rule.threat]]
 88framework = "MITRE ATT&CK"
 89[[rule.threat.technique]]
 90id = "T1562"
 91name = "Impair Defenses"
 92reference = "https://attack.mitre.org/techniques/T1562/"
 93[[rule.threat.technique.subtechnique]]
 94id = "T1562.001"
 95name = "Disable or Modify Tools"
 96reference = "https://attack.mitre.org/techniques/T1562/001/"
 97
 98
 99
100[rule.threat.tactic]
101id = "TA0005"
102name = "Defense Evasion"
103reference = "https://attack.mitre.org/tactics/TA0005/"
104
105[rule.investigation_fields]
106field_names = [
107    "@timestamp",
108    "user.name",
109    "user_agent.original",
110    "source.ip",
111    "aws.cloudtrail.user_identity.arn",
112    "aws.cloudtrail.user_identity.type",
113    "aws.cloudtrail.user_identity.access_key_id",
114    "target.entity.id",
115    "event.action",
116    "event.outcome",
117    "cloud.account.id",
118    "cloud.region",
119    "aws.cloudtrail.request_parameters",
120]