AWS CloudTrail Log Updated

  1[metadata]
  2creation_date = "2020/06/10"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2025/11/07"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects updates to an existing CloudTrail trail via UpdateTrail API which may reduce visibility, change destinations, or
 11weaken integrity (e.g., removing global events, moving the S3 destination, or disabling validation). Adversaries can
 12modify trails to evade detection while maintaining a semblance of logging. Validate any configuration change against
 13approved baselines.
 14"""
 15false_positives = [
 16    """
 17    Trail updates may be made by a system or network administrator. Verify whether the user identity, user agent, and/or
 18    hostname should be making changes in your environment. Trail updates from unfamiliar users or hosts should be
 19    investigated. If known behavior is causing false positives, it can be exempted from the rule.
 20    """,
 21]
 22from = "now-6m"
 23index = ["filebeat-*", "logs-aws.cloudtrail-*"]
 24language = "kuery"
 25license = "Elastic License v2"
 26name = "AWS CloudTrail Log Updated"
 27note = """## Triage and analysis
 28
 29> **Disclaimer**:
 30> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 31
 32### Investigating AWS CloudTrail Log Updated
 33
 34AWS CloudTrail is a service that enables governance, compliance, and operational and risk auditing of your AWS account. It logs API calls and related events, providing visibility into user activity. Trail modifications can be used by attackers to redirect logs to non-approved buckets, drop regions, or disable valuable selectors. This rule identifies a modification on CloudTrail settings using the `UpdateTrail` API. 
 35
 36#### Possible investigation steps
 37- **Actor and context**
 38  - Check `aws.cloudtrail.user_identity.arn`, `user_agent.original`, `source.ip`; verify approved change.
 39- **Assess the modification**
 40  - In `aws.cloudtrail.request_parameters`, note changes to:
 41    - `S3BucketName`, `CloudWatchLogsLogGroupArn`, `KmsKeyId`
 42    - `IsMultiRegionTrail`, `IncludeGlobalServiceEvents`
 43    - Event or insight selectors (management vs data events)
 44- **Correlate**
 45  - Look for preceding `StopLogging` or following `DeleteTrail`.
 46  - Review concurrent IAM policy edits or role changes by the same actor.
 47
 48### False positive analysis
 49- **Planned changes**: Baseline drift during region onboarding or encryption rotation.
 50- **Automation**: IaC pipelines updating trails as templates evolve.
 51
 52### Response and remediation
 53- **If unauthorized**
 54  - Revert to baseline; validate destination ownership and KMS policy.
 55  - Investigate time ranges where visibility may have been reduced.
 56- **Hardening**
 57  - Constrain `cloudtrail:UpdateTrail`, require approvals, and monitor with AWS Config rules.
 58
 59### Additional information
 60- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)** 
 61- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)** 
 62- **Security Best Practices:** [AWS Knowledge Center – Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/).
 63"""
 64references = [
 65    "https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_UpdateTrail.html",
 66    "https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cloudtrail/update-trail.html",
 67]
 68risk_score = 21
 69rule_id = "3e002465-876f-4f04-b016-84ef48ce7e5d"
 70severity = "low"
 71tags = [
 72    "Domain: Cloud",
 73    "Data Source: AWS",
 74    "Data Source: Amazon Web Services",
 75    "Data Source: AWS Cloudtrail",
 76    "Use Case: Log Auditing",
 77    "Resources: Investigation Guide",
 78    "Tactic: Impact",
 79]
 80timestamp_override = "event.ingested"
 81type = "query"
 82
 83query = '''
 84event.dataset: "aws.cloudtrail" 
 85    and event.provider: "cloudtrail.amazonaws.com" 
 86    and event.action: "UpdateTrail" 
 87    and event.outcome: "success"
 88'''
 89
 90
 91[[rule.threat]]
 92framework = "MITRE ATT&CK"
 93[[rule.threat.technique]]
 94id = "T1565"
 95name = "Data Manipulation"
 96reference = "https://attack.mitre.org/techniques/T1565/"
 97[[rule.threat.technique.subtechnique]]
 98id = "T1565.001"
 99name = "Stored Data Manipulation"
100reference = "https://attack.mitre.org/techniques/T1565/001/"
101
102
103
104[rule.threat.tactic]
105id = "TA0040"
106name = "Impact"
107reference = "https://attack.mitre.org/tactics/TA0040/"
108[[rule.threat]]
109framework = "MITRE ATT&CK"
110[[rule.threat.technique]]
111id = "T1530"
112name = "Data from Cloud Storage"
113reference = "https://attack.mitre.org/techniques/T1530/"
114
115
116[rule.threat.tactic]
117id = "TA0009"
118name = "Collection"
119reference = "https://attack.mitre.org/tactics/TA0009/"
120
121[rule.investigation_fields]
122field_names = [
123    "@timestamp",
124    "user.name",
125    "user_agent.original",
126    "source.ip",
127    "aws.cloudtrail.user_identity.arn",
128    "aws.cloudtrail.user_identity.type",
129    "aws.cloudtrail.user_identity.access_key_id",
130    "event.action",
131    "event.outcome",
132    "cloud.account.id",
133    "cloud.region",
134    "aws.cloudtrail.request_parameters",
135    "aws.cloudtrail.response_elements",
136]