AWS CloudTrail Log Updated

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

AWS CloudTrail Log Updated

Detects updates to an existing CloudTrail trail via UpdateTrail API which may reduce visibility, change destinations, or weaken integrity (e.g., removing global events, moving the S3 destination, or disabling validation). Adversaries can modify trails to evade detection while maintaining a semblance of logging. Validate any configuration change against approved baselines.

Rule type: query

Rule indices:

filebeat-*
logs-aws.cloudtrail-*

Severity: low

Risk score: 21

Runs every: 5m

Searches indices from: now-6m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: Cloud
Data Source: AWS
Data Source: Amazon Web Services
Data Source: AWS Cloudtrail
Use Case: Log Auditing
Resources: Investigation Guide
Tactic: Impact

Version: 212

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Disclaimer: This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

Investigating AWS CloudTrail Log Updated

AWS CloudTrail is a service that enables governance, compliance, and operational and risk auditing of your AWS account. It logs API calls and related events, providing visibility into user activity. Trail modifications can be used by attackers to redirect logs to non-approved buckets, drop regions, or disable valuable selectors. This rule identifies a modification on CloudTrail settings using the UpdateTrail API.

Possible investigation steps

Actor and context
Check aws.cloudtrail.user_identity.arn, user_agent.original, source.ip; verify approved change.
Assess the modification
In aws.cloudtrail.request_parameters, note changes to:
S3BucketName, CloudWatchLogsLogGroupArn, KmsKeyId
IsMultiRegionTrail, IncludeGlobalServiceEvents
Event or insight selectors (management vs data events)
Correlate
Look for preceding StopLogging or following DeleteTrail.
Review concurrent IAM policy edits or role changes by the same actor.

False positive analysis

Planned changes: Baseline drift during region onboarding or encryption rotation.
Automation: IaC pipelines updating trails as templates evolve.

Response and remediation

If unauthorized
Revert to baseline; validate destination ownership and KMS policy.
Investigate time ranges where visibility may have been reduced.
Hardening
Constrain cloudtrail:UpdateTrail, require approvals, and monitor with AWS Config rules.

Additional information

AWS IR Playbooks
AWS Customer Playbook Framework
Security Best Practices: AWS Knowledge Center – Security Best Practices.

Rule query

edit

event.dataset: "aws.cloudtrail"
    and event.provider: "cloudtrail.amazonaws.com"
    and event.action: "UpdateTrail"
    and event.outcome: "success"

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Impact
- ID: TA0040
- Reference URL: https://attack.mitre.org/tactics/TA0040/
Technique:
- Name: Data Manipulation
- ID: T1565
- Reference URL: https://attack.mitre.org/techniques/T1565/
Sub-technique:
- Name: Stored Data Manipulation
- ID: T1565.001
- Reference URL: https://attack.mitre.org/techniques/T1565/001/
Tactic:
- Name: Collection
- ID: TA0009
- Reference URL: https://attack.mitre.org/tactics/TA0009/
Technique:
- Name: Data from Cloud Storage
- ID: T1530
- Reference URL: https://attack.mitre.org/techniques/T1530/

« AWS CloudTrail Log Suspended AWS CloudWatch Alarm Deletion »