AWS CloudTrail Management Events Disabled via PutEventSelectors

  1[metadata]
  2creation_date = "2026/07/13"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/07/13"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects CloudTrail PutEventSelectors calls where the legacy event selectors explicitly set includeManagementEvents to
 11false, disabling capture of all management API calls for that trail. Unlike StopLogging or DeleteTrail — which
 12leave an obvious trace of the trail being stopped or removed entirely — this technique leaves the trail appearing
 13active and healthy in the console while silently blinding defenders to subsequent IAM changes, credential operations,
 14and resource abuse. This technique is documented in Stratus Red Team as aws.defense-evasion.cloudtrail-event-selectors
 15and is a known pre-exfiltration step.
 16"""
 17false_positives = [
 18    """
 19    IaC pipelines setting event selectors during trail creation always set includeManagementEvents to true — the rule
 20    will not fire on those calls. The remaining FP vector is an administrator intentionally restricting a trail to
 21    data-events-only for cost reasons. Validate the caller, change management ticket, and confirm this is not a
 22    multi-region or organization-wide trail where the coverage impact would be severe.
 23    """,
 24]
 25from = "now-6m"
 26index = ["logs-aws.cloudtrail-*"]
 27language = "kuery"
 28license = "Elastic License v2"
 29name = "AWS CloudTrail Management Events Disabled via PutEventSelectors"
 30note = """## Triage and analysis
 31
 32### Investigating AWS CloudTrail Management Events Disabled via PutEventSelectors
 33
 34`PutEventSelectors` controls which CloudTrail events a trail captures. This rule fires when the
 35new event selectors explicitly set `includeManagementEvents` to `false` — disabling capture of
 36all management API calls for that trail while leaving it appearing active in the console. This is
 37a surgical evasion technique that does not trigger the existing `StopLogging` or `DeleteTrail`
 38alerts, and can persist silently for days before detection.
 39
 40### Possible investigation steps
 41
 42- **Confirm the intent**: `aws.cloudtrail.request_parameters` contains the full JSON of the new
 43  event selectors. The rule has already matched `includeManagementEvents: false`. Confirm whether
 44  ALL selectors have management events disabled or only some, and whether `ExcludeManagementEventSources`
 45  further filters specific services.
 46
 47- **Check for other narrowing**: Also inspect `ReadWriteType` and `DataResources` in the same
 48  event — switching to `ReadOnly` or removing data event entries compounds the coverage gap.
 49
 50- **Verify the caller**: `aws.cloudtrail.user_identity.arn` — IaC automation (Terraform,
 51  CloudFormation, CDK) uses AssumedRole/ASIA* credentials and legitimately sets management event
 52  selectors to `true` during trail creation. An AKIA* key or Root identity making this change
 53  outside of a deployment pipeline is high-confidence adversarial.
 54
 55- **Check trail scope**: Was this a multi-region trail or organization-wide trail? Changes to
 56  broad-scope trails have the largest visibility impact.
 57
 58- **Correlate activity**: Look for high-impact API calls in the 30–60 minutes following this
 59  event — particularly IAM changes, credential operations, or S3/KMS data access — that would
 60  now be invisible to the trail.
 61
 62- **Prior access**: Check for `GetTrailStatus`, `GetEventSelectors`, or `DescribeTrails` calls
 63  from the same identity before this event, indicating reconnaissance of the trail configuration.
 64
 65### Response and remediation
 66
 67- Immediately call `PutEventSelectors` to restore `includeManagementEvents: true` on all selectors.
 68- Confirm that `GetTrailStatus` shows `IsLogging: true`.
 69- Review all API activity from the time the selectors were modified until detection using
 70  alternative sources (CloudWatch, other regional trails) for the gap window.
 71- Restrict `cloudtrail:PutEventSelectors` to break-glass roles and enforce via SCP.
 72"""
 73references = [
 74    "https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_PutEventSelectors.html",
 75    "https://stratus-red-team.cloud/attack-techniques/AWS/aws.defense-evasion.cloudtrail-event-selectors/",
 76    "https://attack.mitre.org/techniques/T1562/008/",
 77]
 78risk_score = 47
 79rule_id = "20b79388-3225-4a98-b19f-17de8feaa39c"
 80severity = "medium"
 81tags = [
 82    "Domain: Cloud",
 83    "Data Source: AWS",
 84    "Data Source: Amazon Web Services",
 85    "Data Source: AWS CloudTrail",
 86    "Use Case: Log Auditing",
 87    "Tactic: Defense Evasion",
 88    "Resources: Investigation Guide",
 89]
 90timestamp_override = "event.ingested"
 91type = "query"
 92
 93query = '''
 94data_stream.dataset: "aws.cloudtrail"
 95    and event.provider: "cloudtrail.amazonaws.com"
 96    and event.action: "PutEventSelectors"
 97    and event.outcome: "success"
 98    and aws.cloudtrail.request_parameters: *includeManagementEvents*false*
 99'''
100
101
102[[rule.threat]]
103framework = "MITRE ATT&CK"
104[[rule.threat.technique]]
105id = "T1562"
106name = "Impair Defenses"
107reference = "https://attack.mitre.org/techniques/T1562/"
108[[rule.threat.technique.subtechnique]]
109id = "T1562.008"
110name = "Disable or Modify Cloud Logs"
111reference = "https://attack.mitre.org/techniques/T1562/008/"
112
113
114
115[rule.threat.tactic]
116id = "TA0005"
117name = "Defense Evasion"
118reference = "https://attack.mitre.org/tactics/TA0005/"
119
120[rule.investigation_fields]
121field_names = [
122    "@timestamp",
123    "user.name",
124    "user_agent.original",
125    "source.ip",
126    "aws.cloudtrail.user_identity.arn",
127    "aws.cloudtrail.user_identity.type",
128    "aws.cloudtrail.user_identity.access_key_id",
129    "event.action",
130    "event.provider",
131    "event.outcome",
132    "cloud.account.id",
133    "cloud.region",
134    "aws.cloudtrail.request_parameters",
135]