T1562.008: Disable Cloud Logs

MITRE ATT&CK Content An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an adversary has sufficient permissions, they can disable or modify logging to avoid detection of their activities. For example, in AWS an adversary may disable CloudWatch/CloudTrail integrations prior to conducting further malicious activity. They may alternatively tamper with logging functionality for example, by removing any associated SNS topics, disabling multi-region logging, or disabling settings that validate and/or encrypt log files. In Office 365, an adversary may disable logging on mail collection activities for specific users by using the `Set-MailboxAuditBypassAssociation` cmdlet, by disabling M365 Advanced Auditing for the user, or by downgrading the users license from an Enterprise E5 to an Enterprise E3 license. AWS Specific Content A prerequisite for this technique is that a threat actor has already gained control of an AWS identity with the permissions to perform the actions in the AWS CloudTrail Event Name(s) section. With access to an AWS identity that has the appropriate permissions, threat actors may disable cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Using this technique, threat actors can deactivate or modify AWS CloudTrail prior to conducting unauthorized actions in order to hide their activities and evade defenses.